<?xml version="1.0" encoding="UTF-8"?>
<arf:asset-report-collection xmlns:arf="http://scap.nist.gov/schema/asset-reporting-format/1.1" xmlns:core="http://scap.nist.gov/schema/reporting-core/1.1" xmlns:ai="http://scap.nist.gov/schema/asset-identification/1.1">
  <core:relationships xmlns:arfvocab="http://scap.nist.gov/specifications/arf/vocabulary/relationships/1.0#">
    <core:relationship type="arfvocab:createdFor" subject="xccdf1">
      <core:ref>collection1</core:ref>
    </core:relationship>
    <core:relationship type="arfvocab:isAbout" subject="xccdf1">
      <core:ref>asset0</core:ref>
    </core:relationship>
  </core:relationships>
  <arf:report-requests>
    <arf:report-request id="collection1">
      <arf:content>
        <ds:data-stream-collection xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" xmlns:cpe-dict="http://cpe.mitre.org/dictionary/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ind="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:linux="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ocil="http://scap.nist.gov/schema/ocil/2.0" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="scap_org.open-scap_collection_from_xccdf_ssg-fedora-xccdf-1.2.xml" schematron-version="1.3">
  <ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-fedora-xccdf-1.2.xml" scap-version="1.3" use-case="OTHER">
    <ds:dictionaries>
      <ds:component-ref id="scap_org.open-scap_cref_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-dictionary.xml">
        <cat:catalog>
          <cat:uri name="ssg-fedora-cpe-oval.xml" uri="#scap_org.open-scap_cref_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-oval.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:dictionaries>
    <ds:checklists>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-xccdf-1.2.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml">
        <cat:catalog>
          <cat:uri name="ssg-fedora-oval.xml" uri="#scap_org.open-scap_cref_ssg-fedora-oval.xml"/>
          <cat:uri name="ssg-fedora-ocil.xml" uri="#scap_org.open-scap_cref_ssg-fedora-ocil.xml"/>
        </cat:catalog>
      </ds:component-ref>
    </ds:checklists>
    <ds:checks>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-oval.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_ssg-fedora-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-fedora-ocil.xml"/>
      <ds:component-ref id="scap_org.open-scap_cref_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-oval.xml"/>
    </ds:checks>
  </ds:data-stream>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-oval.xml" timestamp="2021-09-30T00:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2021-09-30T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition class="compliance" id="oval:ssg-ftp_log_transactions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Logging of All FTP Transactions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </oval-def:description>
            <oval-def:reference ref_id="ftp_log_transactions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="FTP is not being used or the conditions are met" operator="OR">
            <oval-def:extend_definition comment="vsftp package is not installed" definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true"/>
            <oval-def:criteria comment="FTP configuration conditions are not set or are met" operator="AND">
              <oval-def:criterion comment="log ftp transactions enable" test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1"/>
              <oval-def:criterion comment="log ftp transactions format" test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1"/>
              <oval-def:criterion comment="log ftp transactions protocol" test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ftp_present_banner:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Create Warning Banners for All FTP Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</oval-def:description>
            <oval-def:reference ref_id="ftp_present_banner" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="vsftpd package is not installed" definition_ref="oval:ssg-package_vsftpd_removed:def:1"/>
            <oval-def:criterion comment="Banner for FTP Users" test_ref="oval:ssg-test_ftp_present_banner:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kerberos_disable_no_keytab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kerberos by removing host keytab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that there is no Kerberos keytab file present in /etc</oval-def:description>
            <oval-def:reference ref_id="kerberos_disable_no_keytab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" comment="Restrict Kerberos operation by removing keytab files"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-postfix_client_configure_mail_alias:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure System to Forward All Mail For The Root Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if root has the correct mail alias.</oval-def:description>
            <oval-def:reference ref_id="postfix_client_configure_mail_alias" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if root has the correct mail alias.">
            <oval-def:criterion comment="Check if root has the correct mail alias." test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_insecure_locks_exports:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Insecure File Locking is Not Allowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</oval-def:description>
            <oval-def:reference ref_id="no_insecure_locks_exports" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check for insecure NFS locks in /etc/exports" test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_client_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable chrony daemon from acting as server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the port setting in /etc/chrony.conf to disable
      server operation.</oval-def:description>
            <oval-def:reference ref_id="chronyd_client_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_no_chronyc_network:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable network management of chrony daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the cmdport setting in /etc/chrony.conf to disable
      chronyc management connections over network.</oval-def:description>
            <oval-def:reference ref_id="chronyd_no_chronyc_network" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Time Service Maxpoll Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
      to continuously poll the time source servers.</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_set_maxpoll" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="check if maxpoll is set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1"/>
              <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/ntp.conf" test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="check if maxpoll is set in /etc/chrony.conf" test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1"/>
              <oval-def:criterion comment="check if all server entries have maxpoll set in /etc/chrony.conf" test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="chronyd enabled and multiple remote servers specified" operator="AND">
              <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
              <oval-def:extend_definition comment="multiple chronyd remote servers specified" definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="ntpd enabled and multile remote servers specified" operator="AND">
              <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
              <oval-def:extend_definition comment="multiple ntpd remote servers specified" definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify a Remote NTP Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_or_ntpd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="chronyd enabled and remote server specified" operator="AND">
              <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
              <oval-def:extend_definition comment="chronyd remote server specified" definition_ref="oval:ssg-chronyd_specify_remote_server:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="ntpd enabled and remote server specified" operator="AND">
              <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
              <oval-def:extend_definition comment="ntpd remote server specified" definition_ref="oval:ssg-ntpd_specify_remote_server:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_run_as_chrony_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that chronyd is running under chrony user account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'OPTIONS' is configured with value '["]?.*-u chrony.*["]?' in /etc/sysconfig/chronyd</oval-def:description>
            <oval-def:reference ref_id="chronyd_run_as_chrony_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the OPTIONS in /etc/sysconfig/chronyd" test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user" test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_specify_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>A remote time server for Chrony is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="chronyd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_configure_restrictions:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure server restrictions for ntpd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Certain restrictions are imposed on ntp servers configured to be used by ntpd</oval-def:description>
            <oval-def:reference ref_id="ntpd_configure_restrictions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="test ipv6 configuration" test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1"/>
            <oval-def:criterion comment="test ipv4 configuration" test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_run_as_ntp_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure ntpd To Run As ntp User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure ntpd is configured to run correctly under the ntp user.</oval-def:description>
            <oval-def:reference ref_id="ntpd_run_as_ntp_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="check /etc/sysconfig/ntpd is configured correctly" test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1"/>
            <oval-def:criterion comment="check /usr/lib/systemd/system/ntpd.service is configured correctly" test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Specify Additional Remote NTP Servers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple ntpd NTP Servers for time synchronization should be specified.</oval-def:description>
            <oval-def:reference ref_id="ntpd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ntp.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ntpd_specify_remote_server:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Specify a Remote NTP Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="ntpd_specify_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ntp.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>At least one of the chronyd or ntpd services should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_chronyd_or_ntpd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chronyd or ntpd service enabled" operator="OR">
            <oval-def:extend_definition comment="service chronyd enabled" definition_ref="oval:ssg-service_chronyd_enabled:def:1"/>
            <oval-def:extend_definition comment="service ntpd enabled" definition_ref="oval:ssg-service_ntpd_enabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_rsh_trust_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove Rsh Trust Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>There should not be any .rhosts or hosts.equiv files on the system.</oval-def:description>
            <oval-def:reference ref_id="no_rsh_trust_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-snmpd_not_default_password:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure Default SNMP Password Is Not Used</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SNMP default communities must be removed.</oval-def:description>
            <oval-def:reference ref_id="snmpd_not_default_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="SNMP communities" test_ref="oval:ssg-test_snmp_default_communities:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure SNMP Service to Use Only SNMPv3 or Newer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SNMP version 1 and 2c must not be enabled.</oval-def:description>
            <oval-def:reference ref_id="snmpd_use_newer_protocol" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="SNMP installed" definition_ref="oval:ssg-package_net-snmp_removed:def:1"/>
            <oval-def:criterion comment="SNMP protocols" test_ref="oval:ssg-test_snmp_versions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Allow Only SSH Protocol 2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The OpenSSH daemon should be running protocol 2.</oval-def:description>
            <oval-def:reference ref_id="sshd_allow_only_protocol2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="SSH version is equal or higher than 7.4 or it is configured with protocol 2" operator="OR">
                <oval-def:extend_definition comment="OpenSSH version 7.4 or higher supports only protocol 2" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
                <oval-def:criterion comment="Check Protocol in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_compression:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Compression Or Set Compression to delayed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH should either have compression disabled or set to delayed.</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_compression" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check Compression in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_compression:tst:1"/>
            </oval-def:criteria>
            <oval-def:extend_definition comment="OpenSSH version 7.4 or higher contains fix for authentication Compression exploit" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for Rhosts RSA Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_rhosts_rsa" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="SSH version is equal or higher than 7.4 has deprecated RhostsRSAAuthentication" operator="OR">
                <oval-def:extend_definition comment="OpenSSH version 7.4 or higher has deprecated RhostsRSAAuthentication" definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1"/>
                <oval-def:criterion comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config" negate="true" test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_rekey_limit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Force frequent session key renegotiation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'RekeyLimit' is configured with the correct value in '/etc/ssh/sshd_config'</oval-def:description>
            <oval-def:reference ref_id="sshd_rekey_limit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_rekey_limit:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_idle_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Idle Timeout Interval</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH idle timeout interval should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_idle_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check ClientAliveInterval in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_idle_timeout:tst:1"/>
              <oval-def:extend_definition comment="The SSH ClientAliveCountMax is set to zero" definition_ref="oval:ssg-sshd_set_keepalive:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_keepalive:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</oval-def:description>
            <oval-def:reference ref_id="sshd_set_keepalive" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_max_auth_tries:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH authentication attempt limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH MaxAuthTries should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_max_auth_tries" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is not being used or conditions are met" operator="OR">
            <oval-def:extend_definition comment="sshd service is disabled" definition_ref="oval:ssg-service_sshd_disabled:def:1"/>
            <oval-def:criterion comment="Check MaxAuthTries in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_max_sessions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH MaxSessions limit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SSH number of max sessions should be set to an
      appropriate value.</oval-def:description>
            <oval-def:reference ref_id="sshd_set_max_sessions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criterion comment="Check MaxSessions in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_max_sessions:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_maxstartups:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SSH MaxStartups is configured</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'MaxStartups' is configured in
      '/etc/ssh/sshd_config'</oval-def:description>
            <oval-def:reference ref_id="sshd_set_maxstartups" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
              <oval-def:criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_use_directory_configuration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Distribute the SSH Server configuration to multiple files in a config directory.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>foo</oval-def:description>
            <oval-def:reference ref_id="sshd_use_directory_configuration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="AND">
                <oval-def:extend_definition comment="sshd includes config files from its .d directory" definition_ref="oval:ssg-sshd_includes_config_files:def:1"/>
                <oval-def:criterion comment="Check the absence of match in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_use_priv_separation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Privilege Separation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'UsePrivilegeSeparation' is configured with value 'sandbox' in '/etc/ssh/sshd_config'</oval-def:description>
            <oval-def:reference ref_id="sshd_use_priv_separation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check the UsePrivilegeSeparation in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_certificate_verification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Certificate certificate status checking in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured with the correct ocsp_dgst
            digest function</oval-def:description>
            <oval-def:reference ref_id="sssd_certificate_verification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of certificate_verification in sssd configuration" test_ref="oval:ssg-test_sssd_certificate_verification:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_enable_smartcards:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Smartcards in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to authenticate access to the system
    using smart cards.</oval-def:description>
            <oval-def:reference ref_id="sssd_enable_smartcards" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check pam_cert_auth in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_memcache_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD's Memory Cache to Expire</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD's memory cache should be configured to set to expire records after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_memcache_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check memcache_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to Expire Offline Credentials</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to expire offline credentials after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_offline_cred_expiration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_run_as_sssd_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to run as user sssd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD processes should be configured to run as user sssd, not root.</oval-def:description>
            <oval-def:reference ref_id="sssd_run_as_sssd_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check user setting in SSSD configuration" test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSSD to Expire SSH Known Hosts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSSD should be configured to expire keys from known SSH hosts after 1 day.</oval-def:description>
            <oval-def:reference ref_id="sssd_ssh_known_hosts_timeout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="Check if sssd service is disabled" definition_ref="oval:ssg-service_sssd_disabled:def:1"/>
              <oval-def:extend_definition comment="Check if /etc/sssd/sssd.conf is configured for usage" definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf" test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_usbguard_auditbackend:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Log USBGuard daemon audit events using Linux Audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf</oval-def:description>
            <oval-def:reference ref_id="configure_usbguard_auditbackend" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="usbguard is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="usbguard is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the AuditBackend in /etc/usbguard/usbguard-daemon.conf" test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize Human Interface Devices in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf exists and that it contains at least one non white space character.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hid_and_hub:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hid_and_hub" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_allow_hub:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Authorize USB hubs in USBGuard daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</oval-def:description>
            <oval-def:reference ref_id="usbguard_allow_hub" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." operator="AND">
            <oval-def:extend_definition comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character." definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-xwindows_runlevel_target:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable X Windows Startup By Setting Default Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that the default runlevel target is set to multi-user.target.</oval-def:description>
            <oval-def:reference ref_id="xwindows_runlevel_target" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="default.target systemd softlink exists" test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-banner_etc_issue:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Modify the System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="banner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="/etc/issue is set appropriately" test_ref="oval:ssg-test_banner_etc_issue:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-banner_etc_motd:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Modify the System Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system login banner text should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="banner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="/etc/motd is set appropriately" test_ref="oval:ssg-test_banner_etc_motd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Login Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable the GNOME3 Login warning banner.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_banner_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Enable GUI banner" test_ref="oval:ssg-test_banner_gui_enabled:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the GNOME3 Login Warning Banner Text</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable the GUI warning banner.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_login_banner_text" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable GUI banner and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Prevent user from changing banner" test_ref="oval:ssg-test_prevent_user_banner_change:tst:1"/>
              <oval-def:criterion comment="Login banner is correctly set" test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-display_login_attempts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Displays Last Logon/Access Notification</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the system to notify users of last login/access using pam_lastlog.</oval-def:description>
            <oval-def:reference ref_id="display_login_attempts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions for pam_lastlog are satisfied" test_ref="oval:ssg-test_display_login_attempts:tst:1"/>
            <oval-def:criterion comment="silent option for pam_lastlog is not set" test_ref="oval:ssg-test_display_login_attempts_silent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_pam_namespace:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Up a Private Namespace in PAM Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of pam_namespace.so module in the /etc/pam.d/login file</oval-def:description>
            <oval-def:reference ref_id="enable_pam_namespace" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check that /etc/pam.d/login contains a line with certain text">
            <oval-def:criterion comment="Check that /etc/pam.d/login contains a line with certain text" test_ref="oval:ssg-test_enable_pam_namespace:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_password_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_pwhistory.so is set correctly in password-auth" operator="AND">
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly in password-auth" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse: system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwhistory_remember_system_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_pwhistory.so is set correctly" operator="AND">
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Limit Password Reuse</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The passwords to remember should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_remember" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly" operator="OR">
            <oval-def:criterion comment="remember parameter of pam_unix.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1"/>
            <oval-def:criterion comment="remember parameter of pam_pwhistory.so is set correctly" test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Set Deny For Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of allowed failed logins should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Checks common to both scenarios">
            <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
            <oval-def:criteria operator="AND">
              <oval-def:criteria operator="OR" comment="system-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix even with lines skipped"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix with either sufficient or default=ignore"/>
              </oval-def:criteria>
              <oval-def:criteria operator="OR" comment="password-auth">
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix even with lines skipped"/>
                <oval-def:criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure the root Account for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The root account should be configured to deny access after the number of defined
      failed attempts has been reached.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_deny_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in system-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
            <oval-def:criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in password-auth"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Interval For Counting Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of allowed failed logins should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_interval" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1"/>
            <oval-def:criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1"/>
            <oval-def:criterion comment="authfail default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1"/>
            <oval-def:criterion comment="preauth default is set to 900" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1"/>
            <oval-def:criterion comment="account requires pam_faillock.so in /etc/pam.d/password-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1"/>
            <oval-def:criterion comment="account requires pam_faillock.so in /etc/pam.d/system-auth" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Lockout Time for Failed Password Attempts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The unlock time after number of failed logins should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_unlock_time" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria comment="When ext var unlock_time is zero, all configs must be zero or never">
              <oval-def:criterion comment="Is ext var unlock time zero?" test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1"/>
              <oval-def:criterion comment="Test if config is zero or never" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="When ext var unlock_time is not zero, configs should be zero or never, or greater than or equal the external variable">
              <oval-def:criterion comment="Is ext var unlock time different than zero?" test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" negate="true"/>
              <oval-def:criterion comment="Test if config is greater than or equals the ext var unlock time" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_retry:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password retry should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_retry" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Conditions for retry are satisfied">
            <oval-def:criterion comment="pam_pwquality system-auth" test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/libuser.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_libuserconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Password Hashing Algorithm in /etc/login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/login.defs.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_logindefs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set PAM's Password Hashing Algorithm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</oval-def:description>
            <oval-def:reference ref_id="set_password_hashing_algorithm_systemauth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</oval-def:description>
            <oval-def:reference ref_id="disable_ctrlaltdel_reboot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Disable Ctrl-Alt-Del systemd softlink exists" test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_disable_interactive_boot:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Verify that Interactive Boot is Disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ability for users to perform interactive startups should
      be disabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_disable_interactive_boot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT"/>
              <oval-def:extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-require_emergency_target_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Emergency Systemd Target</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The requirement for a password to boot into emergency mode
      should be configured correctly.</oval-def:description>
            <oval-def:reference ref_id="require_emergency_target_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_emergency_service:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-require_singleuser_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Authentication for Single User Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The requirement for a password to boot into single-user mode
      should be configured correctly.</oval-def:description>
            <oval-def:reference ref_id="require_singleuser_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_require_rescue_service:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_bashrc_exec_tmux:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Support session locking with tmux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if tmux is configured to exec at the end of bashrc.</oval-def:description>
            <oval-def:reference ref_id="configure_bashrc_exec_tmux" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check exec tmux configured at the end of bashrc" operator="AND">
            <oval-def:criterion comment="check tmux is configured to exec on the last line of /etc/bashrc" test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_tmux_lock_after_time:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure tmux to lock session after inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if tmux is configured to lock sessions after period of inactivity.</oval-def:description>
            <oval-def:reference ref_id="configure_tmux_lock_after_time" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Configure tmux to lock session after inactivity" operator="AND">
            <oval-def:criterion comment="check lock-after-time is set to 900 in /etc/tmux.conf" test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_tmux_lock_command:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure the tmux Lock Command</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the vlock command is configured to be used as a locking mechanism in tmux.</oval-def:description>
            <oval-def:reference ref_id="configure_tmux_lock_command" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Configure the tmux Lock Command" operator="AND">
            <oval-def:criterion comment="check lock-command is set to vlock in /etc/tmux.conf" test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_tmux_in_shells:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent user from disabling the screen lock</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that tmux is not listed in /etc/shells</oval-def:description>
            <oval-def:reference ref_id="no_tmux_in_shells" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that tmux is not listed in /etc/shells" operator="AND">
            <oval-def:criterion comment="check that tmux is not listed in /etc/shells" test_ref="oval:ssg-test_no_tmux_in_shells:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_opensc_card_drivers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure opensc Smart Card Drivers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</oval-def:description>
            <oval-def:reference ref_id="configure_opensc_card_drivers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_opensc_nss_db:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure NSS DB To Use opensc</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The NSS DB should be set to use opensc library.</oval-def:description>
            <oval-def:reference ref_id="configure_opensc_nss_db" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-force_opensc_card_drivers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Force opensc To Use Defined Smart Card Driver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Force opensc to use the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</oval-def:description>
            <oval-def:reference ref_id="force_opensc_card_drivers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-smartcard_auth:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Smart Card Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable Smart Card logins</oval-def:description>
            <oval-def:reference ref_id="smartcard_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="smart card authentication is configured" operator="AND">
            <oval-def:extend_definition comment="packages needed for smartcard support are installed" definition_ref="oval:ssg-install_smartcard_packages:def:1"/>
            <oval-def:extend_definition comment="pcscd service is enabled" definition_ref="oval:ssg-service_pcscd_enabled:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:extend_definition comment="esc package is installed" definition_ref="oval:ssg-package_esc_installed:def:1"/>
              <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            </oval-def:criteria>
            <oval-def:criterion comment="cert_policy directive contains oscp_on" test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1"/>
            <oval-def:criteria comment="smart card authentication is enabled or required in system-auth" operator="OR">
              <oval-def:criterion comment="smart card authentication is enabled in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1"/>
              <oval-def:criterion comment="smart card is required in /etc/pam.d/system-auth" test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="smart card is required in /etc/pam.d/smartcard-auth" test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_unique_id:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique User IDs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All accounts on the system should have unique IDs for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="account_unique_id" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_authorized_local_users:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Only Authorized Local User Accounts Exist on Operating System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.</oval-def:description>
            <oval-def:reference ref_id="accounts_authorized_local_users" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" comment="only root user and explicitly authorized users are allowed in /etc/passwd"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Account Expiration Following Inactivity</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The accounts should be configured to expire automatically following password expiration.</oval-def:description>
            <oval-def:reference ref_id="account_disable_post_pw_expiration" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-account_unique_name:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Accounts on the System Have Unique Names</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All accounts on the system should have unique names for proper accountability.</oval-def:description>
            <oval-def:reference ref_id="account_unique_name" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="There should not exist duplicate user name entries in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The maximum password age policy should meet minimum requirements.</oval-def:description>
            <oval-def:reference ref_id="accounts_maximum_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
            <oval-def:criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The minimum password age policy should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_minimum_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Minimum Length in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minimum length should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_minlen_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Warning Age</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password expiration warning age should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_warn_age_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_all_shadowed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_all_shadowed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="password hashes are shadowed" test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify All Account Password Hashes are Shadowed with SHA512</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All password hashes should be shadowed.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_all_shadowed_sha512" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="password hashes are shadowed using sha512" test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - password-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_password_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1"/>
            <oval-def:criteria comment="The value of rounds is no set, in this case the system default is used" operator="AND">
              <oval-def:criterion comment="The default value of rounds is used in pam_unix.so" test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1"/>
              <oval-def:criterion comment="The target value of rounds is the default" test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of Password Hashing Rounds - system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The number of rounds for password hashing should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_unix_rounds_system_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check if rounds option of pam_unix is as expected" operator="OR">
            <oval-def:criterion comment="The value of rounds is set correctly in pam_unix.so" test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1"/>
            <oval-def:criteria comment="The value of rounds is no set, in this case the system default is used" operator="AND">
              <oval-def:criterion comment="The default value of rounds is used in pam_unix.so" test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1"/>
              <oval-def:criterion comment="The target value of rounds is the default" test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gid_passwd_group_same:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</oval-def:description>
            <oval-def:reference ref_id="gid_passwd_group_same" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_empty_passwords:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent Login to Accounts With Empty Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The file /etc/pam.d/system-auth should not contain the nullok option</oval-def:description>
            <oval-def:reference ref_id="no_empty_passwords" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="make sure the nullok option is not used in /etc/pam.d/system-auth" test_ref="oval:ssg-test_no_empty_passwords:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/group</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/group">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/passwd">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure there are no legacy + NIS entries in /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>No lines starting with + are in /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="no_legacy_plus_entries_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="no lines starting with + are in /etc/shadow">
            <oval-def:criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_netrc_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify No netrc Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</oval-def:description>
            <oval-def:reference ref_id="no_netrc_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Only Root Has UID 0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Only the root account should be assigned a user id of 0.</oval-def:description>
            <oval-def:reference ref_id="accounts_no_uid_except_zero" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file" test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_direct_root_logins:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Direct root Logins Not Allowed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</oval-def:description>
            <oval-def:reference ref_id="no_direct_root_logins" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_no_direct_root_logins:tst:1"/>
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_etc_securetty_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that System Accounts Do Not Run a Shell Upon Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The root account is the only system account that should have
      a login shell.</oval-def:description>
            <oval-def:reference ref_id="no_shelllogin_for_systemaccounts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Test SYS_UID_MIN not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1"/>
              <oval-def:criterion comment="Test SYS_UID_MAX not defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1"/>
              <oval-def:criterion comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;" test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Test SYS_UID_MIN defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true"/>
              <oval-def:criterion comment="Test SYS_UID_MAX defined in /etc/login.defs" test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true"/>
              <oval-def:criterion comment="Test shell defined for reserved system UIDs" test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1"/>
              <oval-def:criterion comment="Test shell defined for dynamically allocated system UIDs" test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-restrict_serial_port_logins:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Restrict Serial Port Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</oval-def:description>
            <oval-def:reference ref_id="restrict_serial_port_logins" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="serial ports /etc/securetty" test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-securetty_root_login_console_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Restrict Virtual Console Root Logins</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</oval-def:description>
            <oval-def:reference ref_id="securetty_root_login_console_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="virtual consoles /etc/securetty" test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-use_pam_wheel_for_su:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enforce usage of pam_wheel for su authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Only members of the wheel group should be able to authenticate through the su command.</oval-def:description>
            <oval-def:reference ref_id="use_pam_wheel_for_su" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_have_homedir_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Home Directories are Created for New Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>CREATE_HOME should be enabled</oval-def:description>
            <oval-def:reference ref_id="accounts_have_homedir_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check CREATE_HOME in /etc/login.defs" test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_logon_fail_delay:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</oval-def:description>
            <oval-def:reference ref_id="accounts_logon_fail_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Limit the Number of Concurrent Login Sessions Allowed Per User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</oval-def:description>
            <oval-def:reference ref_id="accounts_max_concurrent_login_sessions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf" test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true"/>
              <oval-def:criterion comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" test_ref="oval:ssg-test_maxlogins:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_polyinstantiated_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
            <oval-def:reference ref_id="accounts_polyinstantiated_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check Polyinstantiation of /tmp Directories">
            <oval-def:criterion comment="Check that /tmp/tmp-inst exists and has mode 000" test_ref="oval:ssg-test_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Polyinstantiation of /var/tmp Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description/>
            <oval-def:reference ref_id="accounts_polyinstantiated_var_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Check Polyinstantiation of /tmp Directories">
            <oval-def:criterion comment="Check that /var/tmp/tmp-inst exists and has mode 000" test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1"/>
            <oval-def:criterion comment="Check configuration of /var/tmp in /etc/security/namespace.conf file" test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_tmout:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Interactive Session Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks interactive shell timeout</oval-def:description>
            <oval-def:reference ref_id="accounts_tmout" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="TMOUT value in /etc/profile &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profile_tmout:tst:1"/>
            <oval-def:criterion comment="TMOUT value in /etc/profile.d/*.sh &lt;= var_accounts_tmout" test_ref="oval:ssg-test_etc_profiled_tmout:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_home_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure that User Home Directories are not Group-Writable or World-Readable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>File permissions should be set correctly for the home directories for all user accounts.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_home_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="home directories" test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check each directory in root's path and make use it does
      not grant write permission to group and other</oval-def:description>
            <oval-def:reference ref_id="accounts_root_path_dirs_no_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that write permission to group and other in root's path is denied">
            <oval-def:criterion comment="Check for write permission to group and other in root's path" test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-root_path_no_dot:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The environment variable PATH should be set correctly for
      the root user.</oval-def:description>
            <oval-def:reference ref_id="root_path_no_dot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="environment variable PATH contains dangerous path" operator="AND">
            <oval-def:criterion comment="environment variable PATH starts with : or ." test_ref="oval:ssg-test_env_var_begins:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains : twice in a row" test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1"/>
            <oval-def:criterion comment="environment variable PATH contains . twice in a row" test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1"/>
            <oval-def:criterion comment="environment variable PATH ends with : or ." test_ref="oval:ssg-test_env_var_ends:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't begin with a /" test_ref="oval:ssg-test_env_var_begins_slash:tst:1"/>
            <oval-def:criterion comment="environment variable PATH doesn't contain relative paths" test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in login.defs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The default umask for all users specified in /etc/login.defs</oval-def:description>
            <oval-def:reference ref_id="accounts_umask_etc_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_umask_etc_profile:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure the Default Umask is Set Correctly in /etc/profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The default umask for all users should be set correctly</oval-def:description>
            <oval-def:reference ref_id="accounts_umask_etc_profile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Syscall Auditing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Syscall auditing should not be disabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_enable_syscall_auditing" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing" test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing" test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_immutable:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Make the auditd Configuration Immutable</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Force a reboot to change audit rules is enabled</oval-def:description>
            <oval-def:reference ref_id="audit_rules_immutable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules configuration locked" test_ref="oval:ssg-test_ari_locked_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl configuration locked" test_ref="oval:ssg-test_ari_locked_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_mac_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Mandatory Access Controls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_mac_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit selinux changes augenrules" test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit selinux changes auditctl" test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/issue augenrules" test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net augenrules" test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts augenrules" test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network augenrules" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/issue auditctl" test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/issue.net auditctl" test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/hosts auditctl" test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/sysconfig/network auditctl" test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1"/>
              <oval-def:extend_definition comment="audit augenrules sethostname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1"/>
              <oval-def:extend_definition comment="audit augenrules setdomainname" definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_session_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Process and Session Initiation Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should capture information about session initiation.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_session_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules utmp" test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules btmp" test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules wtmp" test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl utmp" test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl btmp" test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl wtmp" test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects System Administrator Actions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit actions taken by system administrators on the system.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_sysadmin_actions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoers" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl sudoers_d" test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should detect modification to system files that hold information about users and groups.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1"/>
              <oval-def:criterion comment="audit /etc/security/opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-directory_access_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Access Events to Audit Log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the read events to /var/log/audit</oval-def:description>
            <oval-def:reference ref_id="directory_access_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record read access events to /var/log/audit" test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-directory_permissions_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0750 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks for correct permissions for /var/log/audit.</oval-def:description>
            <oval-def:reference ref_id="directory_permissions_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" negate="true"/>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_var_log_audit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Be Owned By Root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks that all /var/log/audit files and directories are owned by the root user and group.</oval-def:description>
            <oval-def:reference ref_id="file_ownership_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND" comment="directories are root owned">
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log_audit:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>System Audit Logs Must Have Mode 0640 or Less Permissive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks for correct permissions for all log files in /var/log/audit.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
            <oval-def:criteria operator="AND" comment="log_group in auditd.conf is not root">
              <oval-def:extend_definition comment="log_group in auditd.conf is not root" definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1"/>
              <oval-def:criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_umount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount" test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit files deletion events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit rmdir" definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1"/>
            <oval-def:extend_definition comment="audit unlink" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1"/>
            <oval-def:extend_definition comment="audit unlinkat" definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1"/>
            <oval-def:extend_definition comment="audit rename" definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1"/>
            <oval-def:extend_definition comment="audit renameat" definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit creat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1"/>
            <oval-def:extend_definition comment="audit ftruncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1"/>
            <oval-def:extend_definition comment="audit openat" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1"/>
            <oval-def:extend_definition comment="audit open_by_handle_at" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1"/>
            <oval-def:extend_definition comment="audit open" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1"/>
            <oval-def:extend_definition comment="audit truncate" definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit init_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1"/>
            <oval-def:extend_definition comment="audit delete_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1"/>
            <oval-def:extend_definition comment="audit finit_module" definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_delete" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit delete_module" test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit delete_module" test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_finit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit finit_module" test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit finit_module" test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The audit rules should be configured to log information about kernel module loading and unloading.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_kernel_module_loading_init" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit init_module" test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit init_module" test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="audit tallylog" definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1"/>
            <oval-def:extend_definition comment="audit faillock" definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1"/>
            <oval-def:extend_definition comment="audit lastlog" definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of privileged commands are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl suid sgid" test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl binaries count matches rules count" test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through adjtimex</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through adjtimex.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_adjtimex" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit adjtimex" test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit adjtimex" test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through clock_settime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through clock_settime.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_clock_settime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit clock_settime" test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit clock_settime" test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record attempts to alter time through settimeofday</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through settimeofday.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_settimeofday" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit settimeofday" test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit settimeofday" test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_stime:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Time Through stime</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_stime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria comment="32-bit or 64-bit system" operator="OR">
              <oval-def:extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="audit augenrules or audit auditctl" operator="OR">
              <oval-def:criteria comment="audit augenrules stime" operator="AND">
                <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
                <oval-def:criterion comment="audit augenrules 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1"/>
              </oval-def:criteria>
              <oval-def:criteria comment="audit auditctl stime" operator="AND">
                <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
                <oval-def:criterion comment="audit auditctl 32-bit stime" test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter the localtime File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Record attempts to alter time through /etc/localtime.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_time_watch_localtime" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch augenrules" test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit /etc/localtime watch auditctl" test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_configure_remote_server:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure audispd Plugin To Send Logs To Remote Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_configure_remote_server" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="remote_server setting in audisp-remote.conf" test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Encrypt Audit Records Sent With audispd Plugin</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>transport setting in /etc/audit/audisp-remote.conf is set to 'KRB5'</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_encrypt_sent_records" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="setting in audisp-remote.conf" test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd to use audispd's syslog plugin</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes'</oval-def:description>
            <oval-def:reference ref_id="auditd_audispd_syslog_plugin_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="active setting in syslog.conf" test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_disk_error_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Error Action on Disk Error</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>disk_error_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_disk_error_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="disk_error_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_disk_full_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Disk Full Action when Disk Space Is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>disk_full_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_disk_full_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="disk_full_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd mail_acct Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_action_mail_acct" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="action_mail_acct setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd admin_space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_admin_space_left_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="admin_space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_flush:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure auditd flush priority</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The setting for flush in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_flush" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="flush setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Max Log File Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="max_log_file setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_max_log_file_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="max_log_file_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd Number of Logs Retained</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_num_logs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="num_logs setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left Action on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_space_left_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="space_left_action setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure auditd space_left on Low Disk Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</oval-def:description>
            <oval-def:reference ref_id="auditd_data_retention_space_left_percentage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="space_left setting in auditd.conf" test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_overflow_action:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_overflow_action" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="The respective application or service is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the overflow_action in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_overflow_action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_admin_username:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the Boot Loader Admin Username to a Non-Default Value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader superuser should have a username that is hard to guess.</oval-def:description>
            <oval-def:reference ref_id="grub2_admin_username" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system" test_ref="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1"/>
            <oval-def:criterion comment="Superuser is defined in /boot/grub2/grub.cfg and it isn't root, admin, or administrator." test_ref="oval:ssg-test_bootloader_unique_superuser:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_password:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set Boot Loader Password in grub2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader should have password protection enabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system" test_ref="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criteria comment="check both files to account for procedure change in documenation" operator="OR">
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_password_usercfg:tst:1"/>
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion comment="make sure a superuser is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_superuser:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_uefi_admin_username:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The grub2 boot loader superuser should have a username that is hard to guess.</oval-def:description>
            <oval-def:reference ref_id="grub2_uefi_admin_username" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system" test_ref="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1"/>
            <oval-def:criterion comment="make sure a superuser is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_uefi_password:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the UEFI Boot Loader Password</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The UEFI grub2 boot loader should have password protection enabled.</oval-def:description>
            <oval-def:reference ref_id="grub2_uefi_password" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system" test_ref="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criteria comment="check both files to account for procedure change in documenation" operator="OR">
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/user.cfg" test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1"/>
                <oval-def:criterion comment="make sure a password is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1"/>
              </oval-def:criteria>
              <oval-def:criterion comment="make sure a superuser is defined in /boot/grub2/grub.cfg" test_ref="oval:ssg-test_bootloader_uefi_superuser:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Logwatch HostLimit Line</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if HostLimit line in logwatch.conf is set appropriately.</oval-def:description>
            <oval-def:reference ref_id="logwatch_configured_hostlimit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Test value of HostLimit" test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-logwatch_configured_splithosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Logwatch SplitHosts Line</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if SplitHosts line in logwatch.conf is set appropriately.</oval-def:description>
            <oval-def:reference ref_id="logwatch_configured_splithosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Test value of SplitHosts" test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_cron_logging:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure cron Is Logging To Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslog should be configured to capture cron messages.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_cron_logging" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.conf" test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1"/>
            <oval-def:criterion comment="cron is configured in /etc/rsyslog.d" test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must authenticate remote system its sending logs to.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_actionsendstreamdrivermode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslogd must encrypt the off-loading of logs off of the system.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_encrypt_offload_defaultnetstreamdriver" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1"/>
              <oval-def:criterion comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d" test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All syslog log files should be owned by the appropriate group.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_groupownership" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check if all system log files are owned by the appropriate group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Log Files Are Owned By Appropriate User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All syslog log files should be owned by the appropriate user.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_ownership" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check if all system log files are owned by appropriate user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure System Log Files Have Correct Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>File permissions for all syslog log files should be set correctly.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_files_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_access_monitoring:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure remote access methods are monitored in Rsyslog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Rsyslog should be configured to monitor remote access methods.</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_access_monitoring" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="remote access methods are configured in rsyslog" operator="AND">
            <oval-def:criterion comment="ensure 'auth.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1"/>
            <oval-def:criterion comment="ensure 'authpriv.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1"/>
            <oval-def:criterion comment="ensure 'daemon.*' remote method is configured in rsyslog" test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_logrotate_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Logrotate Runs Periodically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </oval-def:description>
            <oval-def:reference ref_id="ensure_logrotate_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists" operator="AND">
            <oval-def:criterion comment="Check if daily is set in /etc/logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1"/>
            <oval-def:criterion comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf" test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1"/>
            <oval-def:criterion comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)" test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_nolisten:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>rsyslogd should reject remote messages</oval-def:description>
            <oval-def:reference ref_id="rsyslog_nolisten" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions are satisfied" test_ref="oval:ssg-test_rsyslog_nolisten:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_loghost:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Logs Sent To Remote Host</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Syslog logs should be sent to a remote loghost</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_loghost" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.conf" test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1"/>
            <oval-def:criterion comment="Remote logging set within /etc/rsyslog.d" test_ref="oval:ssg-test_remote_rsyslog_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_tls:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure TLS for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that all needed TLS-related options are present</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_tls" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that rsyslog is configured to use TLS for remote logging" operator="AND">
            <oval-def:criterion comment="Check that all needed TLS-related options are present" test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rsyslog_remote_tls_cacert:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure CA certificate for rsyslog remote logging</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that the CA certificate path is set</oval-def:description>
            <oval-def:reference ref_id="rsyslog_remote_tls_cacert" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that CA certificate is configured for rsyslog remote logging" operator="AND">
            <oval-def:criterion comment="Check that the CA certificate path is set" test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_disable_zeroconf:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Zeroconf Networking</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</oval-def:description>
            <oval-def:reference ref_id="network_disable_zeroconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Look for NOZEROCONF=yes in /etc/sysconfig/network" test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_nmcli_permissions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>polkit is properly configured to prevent non-privileged users from changing networking settings</oval-def:description>
            <oval-def:reference ref_id="network_nmcli_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" comment="check for properly configured .pkla file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_sniffer_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure System is Not Acting as a Network Sniffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the network sniffer</oval-def:description>
            <oval-def:reference ref_id="network_sniffer_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="promisc interfaces" test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-set_firewalld_default_zone:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Default firewalld Zone for Incoming Packets</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Change the default firewalld zone to drop.</oval-def:description>
            <oval-def:reference ref_id="set_firewalld_default_zone" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Set default zone to drop" test_ref="oval:ssg-test_firewalld_input_drop:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_default_gateway:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Manually Assign IPv6 Router Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Define default gateways for IPv6 traffic</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_default_gateway" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Define default gateways" test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Use Privacy Extensions for Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable privacy extensions for IPv6</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_privacy_extensions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Enable privacy extensions per interface" test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_static_address:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Manually Assign Global IPv6 Address</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Manually configure addresses for IPv6</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_static_address" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="IPv6 disabled or..." definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criterion comment="Set static IPv6 address on each interface" test_ref="oval:ssg-test_network_ipv6_static_address:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Networking Support Automatic Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_ipv6_option_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" comment="ipv6 disabled any modprobe conf file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Support for RPC IPv6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable ipv6 based rpc services</oval-def:description>
            <oval-def:reference ref_id="network_ipv6_disable_rpc" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Disable udp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1"/>
            <oval-def:criterion comment="Disable tcp6" test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-wireless_disable_interfaces:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Deactivate Wireless Network Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All wireless interfaces should be disabled.</oval-def:description>
            <oval-def:reference ref_id="wireless_disable_interfaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="query /proc/net/wireless" test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_root_owned:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Owned by root user</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be owned by root.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_root_owned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have uid greater than 0" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have uid greater than 0" test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that All World-Writable Directories Have Sticky Bits Set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sticky bit should be set for all world-writable directories.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_sticky_bits" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="all local world writable directories have sticky bit set" test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Owned by a System Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be owned by a system user.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_system_owned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have uid greater than or equal to 1000" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have uid greater than or equal to 1000" test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All World-Writable Directories Are Group Owned by a System Account</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All world writable directories should be group owned by a system user.</oval-def:description>
            <oval-def:reference ref_id="dir_perms_world_writable_system_owned_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="check for local directories that are world writable and have gid greater than or equal to 1000" negate="true">
            <oval-def:criterion comment="check for local directories that are world writable and have gid greater than or equal to 1000" test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_systemmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that local System.map file (if exists) is readable only by root</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /boot/System.map-* are only readable by root.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_systemmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SGID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Evaluates to true if all files with SGID set are owned by RPM packages.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_sgid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all sgid files" test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1" class="compliance">
          <oval-def:metadata>
            <oval-def:title>Ensure All SUID Executables Are Authorized</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Evaluates to true if all files with SUID set are owned by RPM packages.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_suid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all suid files" test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No World-Writable Files Exist</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The world-write permission should be disabled for all files.</oval-def:description>
            <oval-def:reference ref_id="file_permissions_unauthorized_world_writable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_ungroupowned:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All files should be owned by a group</oval-def:description>
            <oval-def:reference ref_id="file_permissions_ungroupowned" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all files and make sure they are owned by a group" test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_files_unowned_by_user:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure All Files Are Owned by a User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All files should be owned by a user</oval-def:description>
            <oval-def:reference ref_id="no_files_unowned_by_user" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check all files and make sure they are owned by a user" test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_group_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        directories therein, are group-owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="dir_group_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_dir_group_ownership_lib_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        directories therein, are owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="dir_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_dir_ownership_lib_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dir_permissions_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Directories Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </oval-def:description>
            <oval-def:reference ref_id="dir_permissions_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-dir_test_perms_lib_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupownership_system_commands_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that system commands files are group owned by root </oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by root group.
      </oval-def:description>
            <oval-def:reference ref_id="file_groupownership_system_commands_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_binary_dirs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="file_ownership_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_ownership_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Root Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="file_ownership_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_ownership_lib_dir:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_ownership_lib_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_binary_dirs:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Verify that System Executables Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_binary_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_library_dirs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify that Shared Library Files Have Restrictive Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_library_dirs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_perms_lib_dir:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_perms_lib_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-root_permissions_syslibrary_files:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are owned by root.</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
        are owned by root.
      </oval-def:description>
            <oval-def:reference ref_id="root_permissions_syslibrary_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_nousb_argument:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Support for USB via Bootloader Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GRUB_CMDLINE_LINUX' is configured with value 'nousb' in /etc/default/grub</oval-def:description>
            <oval-def:reference ref_id="grub2_nousb_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="grub is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the GRUB_CMDLINE_LINUX in /etc/default/grub" test_ref="oval:ssg-test_grub2_nousb_argument:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Non-Root Local Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nodev_nonroot_local_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="nodev on local filesystems" test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Bind Mount /var/tmp To /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_tmp_bind" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Ensure /var/tmp is configured to bind mount to /tmp" test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1"/>
            <oval-def:criterion comment="Ensure /var/tmp is mounted" test_ref="oval:ssg-test_mount_option_var_tmp:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Ensure /var/tmp is mounted and binded" test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1"/>
              <oval-def:criterion comment="Ensure /var/tmp and /tmp have the same source device" test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coredump_disable_backtraces:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable core dump backtraces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
            <oval-def:reference ref_id="coredump_disable_backtraces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coredump_disable_storage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dump</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf</oval-def:description>
            <oval-def:reference ref_id="coredump_disable_storage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="systemd-coredump is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the Storage in /etc/systemd/coredump.conf" test_ref="oval:ssg-test_coredump_disable_storage:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_users_coredumps:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for All Users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Core dumps for all users should be disabled</oval-def:description>
            <oval-def:reference ref_id="disable_users_coredumps" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d:tst:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Are core dumps configured in /etc/security/limits.d/*" test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" negate="true"/>
              <oval-def:criterion comment="Are core dumps disabled in /etc/security/limits.conf" test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-umask_for_daemons:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set Daemon Umask</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The daemon umask should be set as appropriate</oval-def:description>
            <oval-def:reference ref_id="umask_for_daemons" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Get value of var_accounts_user_umask variable as octal number" definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable ExecShield via sysctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel runtime parameter 'kernel.exec-shield' should not be disabled and set to 1 on 32-bit systems.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_exec_shield" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
              <oval-def:criterion comment="kernel runtime parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1"/>
              <oval-def:criterion comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1" test_ref="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1"/>
              <oval-def:criterion comment="NX is supported and is not disabled" test_ref="oval:ssg-test_nx_disabled_grub:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-bios_enable_execution_restrictions:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable NX or XD Support in the BIOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The NX (no-execution) bit flag should be set on the system.</oval-def:description>
            <oval-def:reference ref_id="bios_enable_execution_restrictions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NX bit is set" test_ref="oval:ssg-test_NX_cpu_support:tst:1"/>
            <oval-def:criterion comment="No log messages about NX being disabled" test_ref="oval:ssg-test_messages_nx_active:tst:1"/>
            <oval-def:criterion comment="NX is not disabled in the kernel command line" test_ref="oval:ssg-test_noexec_cmd_line:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Install PAE Kernel on Supported 32-bit x86 Systems</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package kernel-PAE should be installed on 32-bit
      systems.</oval-def:description>
            <oval-def:reference ref_id="install_PAE_kernel_on_x86-32" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Not a 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1" negate="true"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Check if PAE or NX is supported by the CPUs" test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" negate="true"/>
              <oval-def:criteria operator="AND">
                <oval-def:extend_definition comment="A 32-bit system" definition_ref="oval:ssg-system_info_architecture_x86:def:1"/>
                <oval-def:criterion comment="Package kernel-PAE is installed" test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1"/>
                <oval-def:criterion comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel" test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_enable_selinux:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux Not Disabled in /etc/default/grub</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </oval-def:description>
            <oval-def:reference ref_id="grub2_enable_selinux" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" test_ref="oval:ssg-test_selinux_default_grub:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1"/>
            <oval-def:criterion comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" test_ref="oval:ssg-test_selinux_grub_dir:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No Device Files are Unlabeled by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</oval-def:description>
            <oval-def:reference ref_id="selinux_all_devicefiles_labeled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="device_t in /dev" test_ref="oval:ssg-test_selinux_dev_device_t:tst:1"/>
            <oval-def:criterion comment="unlabeled_t in /dev" test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure No Daemons are Unconfined by SELinux</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'.</oval-def:description>
            <oval-def:reference ref_id="selinux_confinement_of_daemons" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="no unconfined_service_t in /proc" test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_policytype:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SELinux Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SELinux policy should be set appropriately.</oval-def:description>
            <oval-def:reference ref_id="selinux_policytype" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-selinux_state:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux State is Enforcing</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The SELinux state should be enforcing the local policy.</oval-def:description>
            <oval-def:reference ref_id="selinux_state" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="enforce is disabled" test_ref="oval:ssg-test_etc_selinux_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-prefer_64bit_os:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prefer to use a 64-bit Operating System when supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if the system supports a 64-bit Operating System</oval-def:description>
            <oval-def:reference ref_id="prefer_64bit_os" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Either the OS is 64-bit, or the CPU doesn't support 64-bit (it is 32 or 16 bit)" operator="OR">
            <oval-def:criterion comment="Check if OS is 64-bit" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1"/>
            <oval-def:criterion comment="Check if CPU is not 64-bit" test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_db_up_to_date:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Make sure that the dconf databases are up-to-date with regards to respective keyfiles.</oval-def:description>
            <oval-def:reference ref_id="dconf_db_up_to_date" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="AND">
              <oval-def:criteria comment="check that all DBs in question are up-to-date" operator="OR">
                <oval-def:criterion comment="local database is up-to-date wrt keyfiles" test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1"/>
                <oval-def:criterion comment="no keyfiles applicable to the local database" test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_dconf_user_profile:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure GNOME3 DConf User Profile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The DConf User profile should have the local DB configured.</oval-def:description>
            <oval-def:reference ref_id="enable_dconf_user_profile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criterion comment="dconf user profile exists" test_ref="oval:ssg-test_dconf_user_profile:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login Restart and Shutdown Buttons</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_restart_shutdown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable restart and shutdown buttons" test_ref="oval:ssg-test_disable_restart_buttons:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the GNOME3 Login User List</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 GUI listing of all known users on the login screen.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_user_list" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GUI listing of known users and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable user list" test_ref="oval:ssg-test_disable_user_list:tst:1"/>
              <oval-def:criterion comment="Prevent user from disabling banner" test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the GNOME3 Login Smartcard Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Enable smartcard authentication in the GNOME3 Login GUI.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_enable_smartcard_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable smartcard authentication and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Enable smartcard authentication" test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_login_retries:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set the GNOME3 Login Number of Failures</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Set the GNOME3 number of login failure attempts.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_login_retries" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Set number of login attempts and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Set number of login tries" test_ref="oval:ssg-test_configure_allowed_failures:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GDM Automatic Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_automatic_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
            <oval-def:criterion comment="Disable GDM Automatic Login" test_ref="oval:ssg-test_disable_automatic_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GDM Guest Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_guest_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="gdm installed" definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true"/>
            <oval-def:criterion comment="Disable GDM Guest Login" test_ref="oval:ssg-test_disable_guest_login:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable XDMCP in GDM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf</oval-def:description>
            <oval-def:reference ref_id="gnome_gdm_disable_xdmcp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="gdm is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="gdm is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the Enable in /etc/gdm/custom.conf" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_automount:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_automount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 automount and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount setting" test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_automount_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 automount-open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable automount-open within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_automount_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable automount-open in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing automount-open setting" test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_autorun:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GNOME3 autorun</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable autorun within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_autorun" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable GNOME3 autorun and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable autorun in GNOME3" test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing autorun setting" test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable All GNOME3 Thumbnailers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The system's default desktop environment, GNOME3, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_thumbnailers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable Gnome3 Thumbnailers and prevent user from enabling" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable thumbnailers in GNOME3" test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable WIFI Network Connection Creation in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 wireless network creation settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_wifi_create" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable wifi creation" test_ref="oval:ssg-test_disable_wifi_creation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable WIFI Network Notification in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 wireless network notification.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_wifi_notification" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable wifi notification" test_ref="oval:ssg-test_disable_wifi_notification:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Credential Prompting for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure GNOME3 to require credential prompting for remote access.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_remote_access_credential_prompt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access credentials" test_ref="oval:ssg-test_configure_remote_access_creds:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Require Encryption for Remote Access in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Configure GNOME3 to require encryption for remote access connections.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_remote_access_encryption" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="configure remote access encryption" test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Idle Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen saver should be enabled.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_activation_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle activation has been configured" test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen saver should not be changed by users.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_activation_locked" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle activation and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Inactivity Timeout</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The allowed period of inactivity before the screensaver is activated.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_idle_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="idle delay has been configured" test_ref="oval:ssg-test_screensaver_idle_delay:tst:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_prevent_user_change_idle_delay:tst:1"/>
              <oval-def:criterion comment="idle delay is set correctly" test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Set GNOME3 Screensaver Lock Delay After Activation Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_delay" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock delay is configured" test_ref="oval:ssg-test_screensaver_lock_delay:tst:1"/>
              <oval-def:criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_prevent_user_lock_delay:tst:1"/>
              <oval-def:criterion comment="lock delay is set correctly" test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable GNOME3 Screensaver Lock After Idle Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should be enabled.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock is enabled" test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1"/>
              <oval-def:criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Idle activation of the screen lock should not be changed by users.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_lock_locked" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable screensaver lock and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver lock prevent user from changing" test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Implement Blank Screensaver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The GNOME3 screensaver should be blank.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_mode_blank" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Enable blank screensaver and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver is blank" test_ref="oval:ssg-test_screensaver_mode_blank:tst:1"/>
              <oval-def:criterion comment="screensaver prevent user from changing mode" test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Full User Name on Splash Shield</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>GNOME3 screen splash shield should not display full name of logged in user.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_user_info" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="Disable screensaver user info and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="screensaver user info is disabled" test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1"/>
              <oval-def:criterion comment="screensaver prevent user from changing" test_ref="oval:ssg-test_prevent_user_info_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that users cannot change GNOME3 screensaver idle and lock settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_screensaver_user_locks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing screensaver lock delay" test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure that users cannot change GNOME3 session idle settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_session_idle_user_locks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria comment="check screensaver idle delay and prevent user from changing it" operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="prevent user from changing idle delay" test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_ctrlaltdel_reboot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable Ctrl-Alt-Del" test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_geolocation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Geolocation in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable GNOME3 Geolocation for the clock and system.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_geolocation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable system geolocation" test_ref="oval:ssg-test_disable_sys_geolocation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1"/>
              <oval-def:criterion comment="Disable clock geolocation" test_ref="oval:ssg-test_disable_clock_geolocation:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_power_settings:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Power Settings in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disable GNOME3 power settings.</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_power_settings" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="dconf installed" definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="dconf user profile exists" definition_ref="oval:ssg-enable_dconf_user_profile:def:1"/>
              <oval-def:criterion comment="Disable power settings" test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1"/>
              <oval-def:criterion comment="Prevent user from changing" test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is FIPS 140-2 Certified</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
          The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements.
      </oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_FIPS_certified" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is a certified operating system" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHCOS4" definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 16.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 18.04" definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1"/>
            <oval-def:extend_definition comment="Installed OS is Ubuntu 20.04" definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-installed_OS_is_vendor_supported:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Installed Operating System Is Vendor Supported</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>
        The operating system installed on the system is supported by a vendor that provides security patches.
      </oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_vendor_supported" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Installed operating system is supported by a vendor" operator="OR">
            <oval-def:extend_definition comment="Installed OS is RHEL7" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:extend_definition comment="Installed OS is RHEL8" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL7" definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is OL8" definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE12" definition_ref="oval:ssg-installed_OS_is_sle12:def:1"/>
            <oval-def:extend_definition comment="Installed OS is SLE15" definition_ref="oval:ssg-installed_OS_is_sle15:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_bind_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure BIND to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>BIND should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_bind_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if package bind is not installed" definition_ref="oval:ssg-package_bind_removed:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure System Cryptography Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.</oval-def:description>
            <oval-def:reference ref_id="configure_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/config" test_ref="oval:ssg-test_configure_crypto_policy:tst:1"/>
            <oval-def:criterion comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current" test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1"/>
            <oval-def:criterion comment="Check if update-crypto-policies has been run after config update" test_ref="oval:ssg-test_crypto_policies_updated:tst:1"/>
            <oval-def:criterion comment="Check if /etc/crypto-policies/back-ends/nss.config exists" test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure GnuTLS library to use DoD-approved TLS Encryption</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of +VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0 in /etc/crypto-policies/back-ends/gnutls.config</oval-def:description>
            <oval-def:reference ref_id="configure_gnutls_tls_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/gnutls.config contains a line with certain text" test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_kerberos_crypto_policy:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Configure Kerberos to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Kerberos should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_kerberos_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR" comment="The config file is always a symlink to the backend, but the backend itself may be either a file, or a symlink. For this reason, we need two tests, if one passes, the other one is expected to either fail, or error.">
            <oval-def:criterion comment="kerberos crypto-policy configuration links to same file as kerberos crypto-policy backend" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1"/>
            <oval-def:criterion comment="kerberos crypto-policy configuration links to the crypto-policy backend file" test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_libreswan_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure Libreswan to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Libreswan should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_libreswan_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if package libreswan is not installed" definition_ref="oval:ssg-package_libreswan_installed:def:1" negate="true"/>
            <oval-def:criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_openssl_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure OpenSSL library to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>OpenSSL should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_openssl_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-configure_ssh_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH to use System Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>SSH should be configured to use the system-wide crypto policy setting.</oval-def:description>
            <oval-def:reference ref_id="configure_ssh_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies."/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_ssh_client_crypto_policy:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden SSH client Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf</oval-def:description>
            <oval-def:reference ref_id="harden_ssh_client_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH client is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the Match in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1"/>
            <oval-def:criterion comment="Check the RekeyLimit in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1"/>
            <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1"/>
            <oval-def:criterion comment="Check the Ciphers in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1"/>
            <oval-def:criterion comment="Check the PubkeyAcceptedKeyTypes in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1"/>
            <oval-def:criterion comment="Check the MACs in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1"/>
            <oval-def:criterion comment="Check the KexAlgorithms in /etc/ssh/ssh_config.d/02-ospp.conf" test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Limit the Ciphers to those which are FIPS-approved.</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_ciphers_openssh_conf_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus.">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD Ciphers" test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Harden SSHD Crypto Policy</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'CRYPTO_POLICY' is configured with value ''-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'' in /etc/crypto-policies/back-ends/opensshserver.config</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the CRYPTO_POLICY in /etc/crypto-policies/back-ends/opensshserver.config" test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</oval-def:description>
            <oval-def:reference ref_id="harden_sshd_macs_openssh_conf_crypto_policy" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus.">
            <oval-def:criterion comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD MACs" test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_antivirus:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Virus Scanning Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Antivirus software should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_antivirus" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Antivirus is not being used or conditions are met">
            <oval-def:extend_definition comment="McAfee A/V Installed" definition_ref="oval:ssg-install_mcafee_antivirus:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_hids:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Intrusion Detection Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Intrusion detection software or SELinux should be installed and enabled.</oval-def:description>
            <oval-def:reference ref_id="install_hids" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss:def:1"/>
            <oval-def:criterion comment="SELinux enabled" test_ref="oval:ssg-test_selinux_enforcing:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_antivirus:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install McAfee Virus Scanning Software</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>McAfee Antivirus software should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_antivirus" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Antivirus is not being used or conditions are met" operator="AND">
            <oval-def:extend_definition comment="McAfee Runtime Libraries and Agent" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
            <oval-def:criterion comment="Linuxshield AntiVirus package is installed" test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_cma_rt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the McAfee Runtime Libraries and Linux Agent</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_cma_rt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="McAfee runtime library package installed" test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1"/>
            <oval-def:criterion comment="McAfee management agent package installed" test_ref="oval:ssg-test_mcafee_management_agent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Asset Configuration Compliance Module (ACCM)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the Asset Configuration Compliance Module (ACCM).</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss_accm" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="McAfee ACCM is installed" test_ref="oval:ssg-test_mcafee_accm_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Policy Auditor (PA) Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Install the Policy Auditor (PA) Module.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss_pa" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="McAfee Policy Auditor is installed" test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_dracut_fips_module:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Dracut FIPS Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>fips module should be enabled in Dracut configuration</oval-def:description>
            <oval-def:reference ref_id="enable_dracut_fips_module" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="dracut fips module is enabled" test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-enable_fips_mode:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable FIPS Mode</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if FIPS mode is enabled on the system</oval-def:description>
            <oval-def:reference ref_id="enable_fips_mode" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="check /etc/system-fips exists" definition_ref="oval:ssg-etc_system_fips_exists:def:1"/>
            <oval-def:extend_definition comment="check sysctl crypto.fips_enabled = 1" definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1"/>
            <oval-def:extend_definition comment="Dracut FIPS module is enabled" definition_ref="oval:ssg-enable_dracut_fips_module:def:1"/>
            <oval-def:extend_definition comment="system cryptography policy is configured" definition_ref="oval:ssg-configure_crypto_policy:def:1"/>
            <oval-def:extend_definition comment="Installed OS is FIPS certified" definition_ref="oval:ssg-installed_OS_is_FIPS_certified:def:1"/>
            <oval-def:criterion comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS" test_ref="oval:ssg-test_system_crypto_policy_value:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-etc_system_fips_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure '/etc/system-fips' exists</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check /etc/system-fips exists</oval-def:description>
            <oval-def:reference ref_id="etc_system_fips_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" comment="/etc/system-fips exists"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set kernel parameter 'crypto.fips_enabled' to 1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_crypto_fips_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter crypto.fips_enabled set to 1" test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_build_database:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Build and Test AIDE Database</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The aide database must be initialized.</oval-def:description>
            <oval-def:reference ref_id="aide_build_database" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
            <oval-def:criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_check_audit_tools:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure AIDE to Verify the Audit Tools</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The {{{ full_name }}} operating system file integrity tool must be configured to protect the integrity of the audit tools.</oval-def:description>
            <oval-def:reference ref_id="aide_check_audit_tools" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criterion comment="auditctl is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditctl:tst:1"/>
            <oval-def:criterion comment="auditd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_auditd:tst:1"/>
            <oval-def:criterion comment="ausearch is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_ausearch:tst:1"/>
            <oval-def:criterion comment="aureport is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_aureport:tst:1"/>
            <oval-def:criterion comment="autrace is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_autrace:tst:1"/>
            <oval-def:criterion comment="audispd is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_audispd:tst:1"/>
            <oval-def:criterion comment="augenrules is checked in /etc/aide.conf" test_ref="oval:ssg-test_aide_verify_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-aide_periodic_cron_checking:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Periodic Execution of AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </oval-def:description>
            <oval-def:reference ref_id="aide_periodic_cron_checking" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Aide is installed" definition_ref="oval:ssg-package_aide_installed:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_crond_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron" test_ref="oval:ssg-test_aide_var_cron_checking:tst:1"/>
              <oval-def:criterion comment="run aide with cron.(daily|weekly)" test_ref="oval:ssg-test_aide_crontabs_checking:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rpm_verify_hashes:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Verify File Hashes with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify the RPM digests of system binaries using the RPM database.</oval-def:description>
            <oval-def:reference ref_id="rpm_verify_hashes" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-rpm_verify_permissions:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Verify and Correct File Permissions with RPM</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify the permissions of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</oval-def:description>
            <oval-def:reference ref_id="rpm_verify_permissions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without authentication</oval-def:description>
            <oval-def:reference ref_id="sudo_remove_no_authenticate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers" test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="!authenticate does not exist in /etc/sudoers.d" test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_remove_nopasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
            <oval-def:reference ref_id="sudo_remove_nopasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers" test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD is not configured in /etc/sudoers.d" test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_require_authentication:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage without password</oval-def:description>
            <oval-def:reference ref_id="sudo_require_authentication" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1"/>
            <oval-def:extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_vdsm_nopasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Only the VDSM User Can Use sudo NOPASSWD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudo usage for the vdsm user without a password</oval-def:description>
            <oval-def:reference ref_id="sudo_vdsm_nopasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1"/>
            <oval-def:criterion comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_explicit_command_args:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Explicit arguments in sudo specifications</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't contain commands without arguments specified</oval-def:description>
            <oval-def:reference ref_id="sudoers_explicit_command_args" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no commands are without arguments" test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_no_command_negation:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Don't define allowed commands in sudoers by means of exclusion</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't contain command negations</oval-def:description>
            <oval-def:reference ref_id="sudoers_no_command_negation" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no command in user spec contains negation" test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_no_root_target:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Don't target root user in the sudoers file</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that sudoers doesn't allow users to run commands as root</oval-def:description>
            <oval-def:reference ref_id="sudoers_no_root_target" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1"/>
            <oval-def:criterion comment="Make sure that all user specs in sudoers feature a runas spec" test_ref="oval:ssg-test_no_user_spec_rules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudoers_validate_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure invoking users password for privilege escalation when using sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure invoking user's password for privilege escalation when using sudo</oval-def:description>
            <oval-def:reference ref_id="sudoers_validate_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Check Defaults !targetpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !rootpw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1"/>
            <oval-def:criterion comment="Check Defaults !runaspw exists in /etc/sudoers file" test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dnf-automatic_apply_updates:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Available Updates Automatically</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'apply_updates' is configured with value 'yes in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
            <oval-def:reference ref_id="dnf-automatic_apply_updates" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the apply_updates in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dnf-automatic_security_updates_only:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Configure dnf-automatic to Install Only Security Updates</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'upgrade_type' is configured with value 'security in section 'commands' in /etc/dnf/automatic.conf</oval-def:description>
            <oval-def:reference ref_id="dnf-automatic_security_updates_only" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dnf-automatic is configured correctly and configuration file exists" operator="AND">
            <oval-def:criteria comment="dnf-automatic is configured correctly" operator="OR">
              <oval-def:criterion comment="Check the upgrade_type in /etc/dnf/automatic.conf" test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1"/>
            </oval-def:criteria>
            <oval-def:criterion comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure Fedora GPG Key Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The Fedora release key package is required to be installed.</oval-def:description>
            <oval-def:reference ref_id="ensure_fedora_gpgkey_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Fedora Vendor keys" operator="AND">
            <oval-def:extend_definition comment="Fedora installed" definition_ref="oval:ssg-installed_OS_is_fedora:def:1"/>
            <oval-def:criteria comment="Supported Fedora key is installed" operator="OR">
              <oval-def:criterion comment="Fedora 35 package gpg-pubkey-9867c58f-601c49ca is installed" test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1"/>
              <oval-def:criterion comment="Fedora 34 package gpg-pubkey-45719a39-5f2c0192 is installed" test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1"/>
              <oval-def:criterion comment="Fedora 33 package gpg-pubkey-9570ff31-5e3006fb is installed" test_ref="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled In Main dnf Configuration</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_globally_activated" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="check value of gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for Local Packages</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_local_packages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf" test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gpgcheck Enabled for All dnf Package Repositories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure all yum or dnf repositories utilize signature checking.</oval-def:description>
            <oval-def:reference ref_id="ensure_gpgcheck_never_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="ensure all yum or dnf repositories utilize signiature checking" operator="AND">
            <oval-def:criterion comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files" test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_dcredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password dcredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_dcredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for dcredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_dictcheck:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password dictcheck should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_dictcheck" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for dictcheck are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_difok:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password difok should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_difok" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for difok are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_enforce_local:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of local_users_only in /etc/security/pwquality.conf</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_enforce_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 1 extra definitions.">
            <oval-def:extend_definition comment="extend_definition added explicitly" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="Check that /etc/security/pwquality.conf contains a line with certain text" test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_enforce_root:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Enforce for root User</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of enforce_for_root in /etc/security/pwquality.conf</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_enforce_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 1 extra definitions.">
            <oval-def:extend_definition comment="extend_definition added explicitly" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="Check that /etc/security/pwquality.conf contains a line with certain text" test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_lcredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password lcredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_lcredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for lcredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password maxclassrepeat should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_maxclassrepeat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for maxclassrepeat are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Password Maximum Consecutive Repeating Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password maxrepeat should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_maxrepeat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for maxrepeat are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_minclass:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minclass should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_minclass" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for minclass are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_minlen:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Length</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password minlen should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_minlen" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for minlen are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_ocredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password ocredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_ocredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for ocredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_ucredit:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The password ucredit should meet minimum requirements</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_ucredit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="conditions for ucredit are satisfied">
            <oval-def:extend_definition comment="pwquality.so exists in system-auth" definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1"/>
            <oval-def:criterion comment="pwquality.conf" test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enforce pam_faillock for Local Accounts Only</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of local_users_only in /etc/security/faillock.conf</oval-def:description>
            <oval-def:reference ref_id="accounts_passwords_pam_faillock_enforce_local" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 1 extra definitions.">
            <oval-def:extend_definition comment="extend_definition added explicitly" definition_ref="oval:ssg-accounts_password_pam_faillock:def:1"/>
            <oval-def:criterion comment="Check that /etc/security/faillock.conf contains a line with certain text" test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_chmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chmod" test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit chmod" test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit chown" test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit chown" test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmod" test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmod" test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchmodat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchmodat" test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchmodat" test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchown" test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchown" test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fchownat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fchownat" test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fchownat" test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fremovexattr" test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fremovexattr" test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_fsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit fsetxattr" test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit fsetxattr" test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lchown" test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lchown" test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lremovexattr" test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lremovexattr" test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_lsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit lsetxattr" test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit lsetxattr" test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_removexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit removexattr" test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit removexattr" test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_setxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setxattr" test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit setxattr" test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_dac_modification_umount2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Discretionary Access Controls - umount2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_dac_modification_umount2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit umount2" test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit umount2" test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_group_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/group</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_group_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/group" test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/gshadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_gshadow_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/gshadow" test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_passwd_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/passwd</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_passwd_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/passwd" test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_etc_shadow_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the write events to /etc/shadow</oval-def:description>
            <oval-def:reference ref_id="audit_rules_etc_shadow_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit rule to record write events to /etc/shadow" test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_chcon:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run chcon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chcon is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_chcon" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chcon" test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_restorecon:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run restorecon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of restorecon is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_restorecon" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl restorecon" test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_semanage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of semanage is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_semanage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl semanage" test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_setsebool:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run setsebool</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of setsebool is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_setsebool" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl setsebool" test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_execution_seunshare:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run seunshare</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of seunshare is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_execution_seunshare" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl seunshare" test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rename</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rename" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rename" test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit rename" test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - renameat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_renameat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit renameat" test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit renameat" test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - rmdir</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_rmdir" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit rmdir" test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit rmdir" test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlink</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlink" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlink" test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlink" test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects File Deletion Events by User - unlinkat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The deletion of files should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_file_deletion_events_unlinkat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit unlinkat" test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit unlinkat" test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_faillock:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - faillock</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_faillock" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules faillock" test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl faillock" test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - lastlog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_lastlog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules lastlog" test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl lastlog" test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Record Attempts to Alter Logon and Logout Events - tallylog</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules should be configured to log successful and unsuccessful login and logout events.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_login_events_tallylog" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules tallylog" test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl tallylog" test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_media_export:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on Exporting to Media (successful)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The changing of file permissions and attributes should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_media_export" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit mount" test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit mount" test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of at is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl at" test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_chage:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chage is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chage" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chage" test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of chsh is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_chsh" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl chsh" test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of crontab is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_crontab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl crontab" test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of gpasswd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_gpasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl gpasswd" test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_mount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of mount is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_mount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl mount" test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newgidmap is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newgidmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newgidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newgidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newgrp is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newgrp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newgrp" test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of newuidmap is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_newuidmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules newuidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl newuidmap" test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of passwd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl passwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of pt_chown is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_pt_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules pt_chown" test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl pt_chown" test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of ssh_keysign is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_ssh_keysign" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl ssh_keysign" test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_su:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of su is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_su" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl su" test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of sudo is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudo" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of sudoedit is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_sudoedit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl sudoedit" test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_umount:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of umount is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_umount" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl umount" test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of unix_chkpwd is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_unix_chkpwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl unix_chkpwd" test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of userhelper is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_userhelper" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl userhelper" test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the use of usernetctl is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_privileged_commands_usernetctl" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl usernetctl" test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - chmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_chmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - chown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_chown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - creat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fchmod</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchmod" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fchmodat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchmodat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - fchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - fchownat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fchownat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - fsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_fsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - ftruncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_ftruncate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Ownership Changes to Files - lchown</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lchown" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - lremovexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lremovexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - lsetxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_lsetxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open_by_handle_at is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule open 32bit a1&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule open 64bit a1&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_open_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - openat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat O_CREAT is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_o_creat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;0100 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat O_TRUNC is enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eacces augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eperm augenrules exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="Verify audit rule openat 32bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eacces auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="Verify audit rule openat 64bit a2&amp;01003 eperm auditctl exists" test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the information on the unsuccessful use of openat is configured in the proper rule order.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_openat_rule_order" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 32-bit" test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - removexattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_removexattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - rename</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_rename" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - renameat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_renameat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Permission Changes to Files - setxattr</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_setxattr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessful Access Attempts to Files - truncate</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_truncate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - unlink</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_unlink" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Unsuccessul Delete Attempts to Files - unlinkat</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_unsuccessful_file_modification_unlinkat" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit augenrules 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1"/>
                  <oval-def:criterion comment="audit augenrules 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eacces" test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit file eperm" test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit_system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criteria operator="AND">
                  <oval-def:criterion comment="audit auditctl 64-bit file eacces" test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1"/>
                  <oval-def:criterion comment="audit auditctl 64-bit file eperm" test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1"/>
                </oval-def:criteria>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit group" test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/gshadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit gshadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/security/opasswd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_opasswd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit opasswd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/passwd</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit passwd" test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify User/Group Information - /etc/shadow</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Audit user/group modification.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_usergroup_modification_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1"/>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit shadow" test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_freq:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set number of records to cause an explicit flush to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_freq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the freq in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_freq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_local_events:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Include Local Events in Audit Logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_local_events" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the local_events in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_local_events:tst:1"/>
            <oval-def:criterion comment="Check the absence of local_events in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_log_format:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Resolve information before writing to audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_log_format" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the log_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_log_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_name_format:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set hostname as computer node name in audit logs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'name_format' is configured with value 'hostname' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_name_format" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the name_format in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_name_format:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_write_logs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Write Audit Logs to the Disk</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf</oval-def:description>
            <oval-def:reference ref_id="auditd_write_logs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="auditd is configured correctly" operator="OR">
            <oval-def:criterion comment="Check the write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs:tst:1"/>
            <oval-def:criterion comment="Check the absence of write_logs in /etc/audit/auditd.conf" test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure SELinux Not Disabled in the kernel arguments</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure selinux=0 argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline.</oval-def:description>
            <oval-def:reference ref_id="coreos_enable_selinux_kernel_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criteria operator="OR">
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Pass if there are no files matching pattern '/boot/loader/entries/ostree-2-.*.conf' exist in the system" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1"/>
                <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-1-.*.conf" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" negate="true"/>
              </oval-def:criteria>
              <oval-def:criteria operator="AND">
                <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-2-.*.conf" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" negate="true"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="Check if argument selinux=0 for Linux kernel is not present in /proc/cmdline" test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_disable_user_admin:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable User Administration in GNOME3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'user-administration-disabled' is configured with value 'true in section 'org/gnome/desktop/lockdown' in /etc/dconf/db/local.d/</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_disable_user_admin" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dconf is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the user-administration-disabled in /etc/dconf/db/local.d/" test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1"/>
            <oval-def:criterion comment="Prevent user from modifying user-administration-disabled" test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the GNOME3 Screen Locking On Smartcard Removal</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'removal-action' is configured with value ''lock-screen' in section 'org/gnome/settings-daemon/peripherals/smartcard' in /etc/dconf/db/local.d/</oval-def:description>
            <oval-def:reference ref_id="dconf_gnome_lock_screen_on_smartcard_removal" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="dconf is configured correctly" operator="AND">
            <oval-def:criterion comment="Check the removal-action in /etc/dconf/db/local.d/" test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1"/>
            <oval-def:criterion comment="Prevent user from modifying removal-action" test_ref="oval:ssg-test_prevent_user_removal-action:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-disable_host_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Host-Based Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="disable_host_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_disable_host_auth:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of HostbasedAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of HostbasedAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group- is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/group-" test_ref="oval:ssg-test_file_groupowner_backup_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow- is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd- is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/passwd-" test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow- is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/shadow-" test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /boot/efi/EFI/fedora/grub.cfg" test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/group" test_ref="oval:ssg-test_file_groupowner_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/gshadow" test_ref="oval:ssg-test_file_groupowner_etc_gshadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership of System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/issue is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/issue" test_ref="oval:ssg-test_file_groupowner_etc_issue:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Ownership of Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/motd is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/motd" test_ref="oval:ssg-test_file_groupowner_etc_motd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/passwd" test_ref="oval:ssg-test_file_groupowner_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /etc/shadow" test_ref="oval:ssg-test_file_groupowner_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Group Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_groupowner_grub2_cfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/ is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /var/log/" test_ref="oval:ssg-test_file_groupowner_var_log:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_groupowner_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/messages is group owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_groupowner_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file group ownership of /var/log/messages" test_ref="oval:ssg-test_file_groupowner_var_log_messages:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group- is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/group-" test_ref="oval:ssg-test_file_owner_backup_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow- is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/gshadow-" test_ref="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd- is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/passwd-" test_ref="oval:ssg-test_file_owner_backup_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Group Who Owns Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow- is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/shadow-" test_ref="oval:ssg-test_file_owner_backup_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /boot/efi/EFI/fedora/grub.cfg" test_ref="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/group" test_ref="oval:ssg-test_file_owner_etc_group:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/gshadow" test_ref="oval:ssg-test_file_owner_etc_gshadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ownership of System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/issue is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/issue" test_ref="oval:ssg-test_file_owner_etc_issue:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ownership of Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/motd is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/motd" test_ref="oval:ssg-test_file_owner_etc_motd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/passwd" test_ref="oval:ssg-test_file_owner_etc_passwd:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /etc/shadow" test_ref="oval:ssg-test_file_owner_etc_shadow:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg User Ownership</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_owner_grub2_cfg:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/ is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /var/log/" test_ref="oval:ssg-test_file_owner_var_log:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_owner_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify User Who Owns /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/messages is owned by 0.</oval-def:description>
            <oval-def:reference ref_id="file_owner_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file ownership of /var/log/messages" test_ref="oval:ssg-test_file_owner_var_log_messages:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/group-" test_ref="oval:ssg-test_file_permissions_backup_etc_group:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/gshadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/passwd-" test_ref="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_backup_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on Backup shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_backup_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/shadow-" test_ref="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify the UEFI Boot Loader grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_efi_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /boot/efi/EFI/fedora/grub.cfg" test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_audit_auditd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/audit/auditd.conf has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_audit_auditd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/audit/auditd.conf" test_ref="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /etc/audit/rules.d/*.rules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/audit/rules.d/ has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_audit_rulesd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/audit/rules.d/" test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on group File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/group has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_group" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/group" test_ref="oval:ssg-test_file_permissions_etc_group:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on gshadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/gshadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_gshadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/gshadow" test_ref="oval:ssg-test_file_permissions_etc_gshadow:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_issue:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify permissions on System Login Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/issue has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_issue" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/issue" test_ref="oval:ssg-test_file_permissions_etc_issue:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_motd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify permissions on Message of the Day Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/motd has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_motd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/motd" test_ref="oval:ssg-test_file_permissions_etc_motd:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on passwd File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/passwd has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_passwd" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/passwd" test_ref="oval:ssg-test_file_permissions_etc_passwd:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on shadow File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/shadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_etc_shadow" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/shadow" test_ref="oval:ssg-test_file_permissions_etc_shadow:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify /boot/grub2/grub.cfg Permissions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /boot/grub2/grub.cfg has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_grub2_cfg" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /boot/grub2/grub.cfg" test_ref="oval:ssg-test_file_permissions_grub2_cfg:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Private *_key Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/ssh/ has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_sshd_private_key" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/ssh/" test_ref="oval:ssg-test_file_permissions_sshd_private_key:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on SSH Server Public *.pub Key Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /etc/ssh/ has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_sshd_pub_key" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /etc/ssh/" test_ref="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log Directory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /var/log/" test_ref="oval:ssg-test_file_permissions_var_log:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-file_permissions_var_log_messages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify Permissions on /var/log/messages File</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>This test makes sure that /var/log/messages has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </oval-def:description>
            <oval-def:reference ref_id="file_permissions_var_log_messages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check file mode of /var/log/messages" test_ref="oval:ssg-test_file_permissions_var_log_messages:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_audit_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure audit=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_audit_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" comment="Check if audit=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Extend Audit Backlog Limit for the Audit Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure audit_backlog_limit=8192 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_audit_backlog_limit_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" comment="Check if audit_backlog_limit=8192 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_enable_iommu_force:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>IOMMU configuration directive</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure iommu=force is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_enable_iommu_force" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" comment="Check if iommu=force is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_ipv6_disable_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Ensure IPv6 is disabled through kernel boot parameter</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure ipv6.disable=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_ipv6_disable_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" comment="Check if ipv6.disable=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_page_poison_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable page allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure page_poison=1 is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_page_poison_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" comment="Check if page_poison=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_pti_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Page-Table Isolation (KPTI)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure pti=on is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_pti_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" comment="Check if pti=on is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_slub_debug_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Enable SLUB/SLAB allocator poisoning</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure slub_debug=P is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_slub_debug_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" comment="Check if slub_debug=P is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_vsyscall_argument:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Disable vsyscalls</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure vsyscall=none is configured in the kernel line in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_vsyscall_argument" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" comment="Check if vsyscall=none is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_smartcard_packages:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install Smart Card Packages For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssl-pkcs11 should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_smartcard_packages" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssl-pkcs11 is installed" test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_atm_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable ATM Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module atm should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_atm_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" comment="kernel module atm disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" comment="kernel module atm disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" comment="kernel module atm disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" comment="kernel module atm disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" comment="kernel module atm disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" comment="kernel module atm disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" comment="kernel module atm disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Bluetooth Kernel Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module bluetooth should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_bluetooth_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" comment="kernel module bluetooth disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" comment="kernel module bluetooth disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" comment="kernel module bluetooth disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_can_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable CAN Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module can should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_can_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" comment="kernel module can disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" comment="kernel module can disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" comment="kernel module can disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" comment="kernel module can disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" comment="kernel module can disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" comment="kernel module can disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" comment="kernel module can disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of cramfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module cramfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_cramfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" comment="kernel module cramfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" comment="kernel module cramfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" comment="kernel module cramfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable DCCP Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module dccp should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_dccp_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" comment="kernel module dccp disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" comment="kernel module dccp disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" comment="kernel module dccp disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" comment="kernel module dccp disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" comment="kernel module dccp disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_firewire-core_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable IEEE 1394 (FireWire) Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module firewire-core should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_firewire-core_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" comment="kernel module firewire-core disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" comment="kernel module firewire-core disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" comment="kernel module firewire-core disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of freevxfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module freevxfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_freevxfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" comment="kernel module freevxfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" comment="kernel module freevxfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" comment="kernel module freevxfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of hfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module hfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_hfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" comment="kernel module hfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" comment="kernel module hfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" comment="kernel module hfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" comment="kernel module hfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" comment="kernel module hfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of hfsplus</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module hfsplus should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_hfsplus_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" comment="kernel module hfsplus disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" comment="kernel module hfsplus disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" comment="kernel module hfsplus disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of jffs2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module jffs2 should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_jffs2_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" comment="kernel module jffs2 disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" comment="kernel module jffs2 disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" comment="kernel module jffs2 disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_rds_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable RDS Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module rds should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_rds_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" comment="kernel module rds disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" comment="kernel module rds disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" comment="kernel module rds disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" comment="kernel module rds disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" comment="kernel module rds disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" comment="kernel module rds disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" comment="kernel module rds disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of squashfs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module squashfs should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_squashfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" comment="kernel module squashfs disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" comment="kernel module squashfs disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" comment="kernel module squashfs disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable TIPC Support</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module tipc should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_tipc_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" comment="kernel module tipc disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" comment="kernel module tipc disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" comment="kernel module tipc disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" comment="kernel module tipc disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" comment="kernel module tipc disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" comment="kernel module tipc disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" comment="kernel module tipc disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_udf_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of udf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module udf should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_udf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" comment="kernel module udf disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" comment="kernel module udf disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" comment="kernel module udf disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" comment="kernel module udf disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" comment="kernel module udf disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Modprobe Loading of USB Storage Driver</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module usb-storage should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_usb-storage_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" comment="kernel module usb-storage disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" comment="kernel module usb-storage disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" comment="kernel module usb-storage disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-kernel_module_vfat_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Mounting of vFAT filesystems</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel module vfat should be disabled.</oval-def:description>
            <oval-def:reference ref_id="kernel_module_vfat_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" comment="kernel module vfat disabled in /etc/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" comment="kernel module vfat disabled in /etc/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" comment="kernel module vfat disabled in /run/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" comment="kernel module vfat disabled in /usr/lib/modules-load.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" comment="kernel module vfat disabled in /run/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" comment="kernel module vfat disabled in /usr/lib/modprobe.d"/>
            <oval-def:criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" comment="kernel module vfat disabled in /etc/modprobe.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_noauto:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noauto Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option noauto.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_noauto" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noauto on /boot" test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /boot" test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /boot" test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_boot_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /boot</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/boot should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_boot_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /boot" test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /dev/shm</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/dev/shm should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_dev_shm_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /dev/shm" test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1"/>
            <oval-def:criterion comment="/dev/shm does not exist" test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_home_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /home</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/home should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_home_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /home" test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nodev option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nodev_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The noexec option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_noexec_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="5">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to Removable Media Partitions</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nosuid option should be enabled for all removable devices mounts in /etc/fstab.</oval-def:description>
            <oval-def:reference ref_id="mount_option_nosuid_removable_partitions" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Check if removable partition really exists on the system" definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="Check if removable partition value represents CD/DVD drive" definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
                <oval-def:extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_opt_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /opt</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/opt should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_opt_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /opt" test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_srv_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /srv</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/srv should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_srv_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /srv" test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /tmp" test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /tmp" test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_tmp_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /tmp</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/tmp should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_tmp_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log/audit</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log/audit should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_audit_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var/log/audit" test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var/log" test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var/log" test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_log_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var/log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var/log should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_log_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var/log" test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_nodev:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nodev Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option nodev.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_nodev" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nodev on /var" test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add noexec Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option noexec.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="noexec on /var" test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-mount_option_var_nosuid:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Add nosuid Option to /var</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>/var should be mounted with mount option nosuid.</oval-def:description>
            <oval-def:reference ref_id="mount_option_var_nosuid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="nosuid on /var" test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_GConf2_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_GConf2_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package GConf2 should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_GConf2_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package GConf2 is installed" test_ref="oval:ssg-test_package_GConf2_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_MFEhiplsm_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the Host Intrusion Prevention System (HIPS) Module</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package MFEhiplsm should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_MFEhiplsm_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package MFEhiplsm is installed" test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-addon-ccpp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-addon-ccpp should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-addon-ccpp_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-addon-ccpp is removed" test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-addon-kerneloops Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-addon-kerneloops should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-addon-kerneloops_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-addon-kerneloops is removed" test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-addon-python_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-addon-python Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-addon-python should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-addon-python_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-addon-python is removed" test_ref="oval:ssg-test_package_abrt-addon-python_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-cli_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-cli Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-cli should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-cli_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-cli is removed" test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-logger_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-logger Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-logger should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-logger_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-logger is removed" test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-rhtsupport Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-rhtsupport should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-rhtsupport_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-rhtsupport is removed" test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall abrt-plugin-sosreport Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt-plugin-sosreport should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt-plugin-sosreport_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt-plugin-sosreport is removed" test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_abrt_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall Automatic Bug Reporting Tool (abrt)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package abrt should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_abrt_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package abrt is removed" test_ref="oval:ssg-test_package_abrt_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_aide_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install AIDE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package aide should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_aide_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package aide is installed" test_ref="oval:ssg-test_package_aide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audispd-plugins_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install audispd-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audispd-plugins should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audispd-plugins_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audispd-plugins is installed" test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audit-audispd-plugins_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the default plugins for the audit dispatcher are Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audit-audispd-plugins should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audit-audispd-plugins_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audit-audispd-plugins is installed" test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_audit_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure the audit Subsystem is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package audit should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_audit_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package audit is installed" test_ref="oval:ssg-test_package_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_avahi_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_avahi_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package avahi should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_avahi_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package avahi is installed" test_ref="oval:ssg-test_package_avahi_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_bind_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall bind Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package bind should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_bind_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package bind is removed" test_ref="oval:ssg-test_package_bind_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_binutils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install binutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package binutils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_binutils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package binutils is installed" test_ref="oval:ssg-test_package_binutils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_chrony_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Chrony package is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package chrony should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_chrony_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package chrony is installed" test_ref="oval:ssg-test_package_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the cron service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package cron should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_cron_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_cryptsetup-luks_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install cryptsetup-luks Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package cryptsetup-luks should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_cryptsetup-luks_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package cryptsetup-luks is installed" test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_dconf_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_dconf_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package dconf should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_dconf_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package dconf is installed" test_ref="oval:ssg-test_package_dconf_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_dnf-automatic_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install dnf-automatic Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package dnf-automatic should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_dnf-automatic_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package dnf-automatic is installed" test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_esc_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_esc_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package esc should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_esc_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package esc is installed" test_ref="oval:ssg-test_package_esc_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_fapolicyd_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install fapolicyd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package fapolicyd should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_fapolicyd_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package fapolicyd is installed" test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gdm_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_gdm_installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gdm should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_gdm_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gdm is installed" test_ref="oval:ssg-test_package_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gdm_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the GDM Package Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gdm should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_gdm_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gdm is removed" test_ref="oval:ssg-test_package_gdm_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_geolite2-city_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall geolite2-city Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package geolite2-city should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_geolite2-city_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package geolite2-city is removed" test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_geolite2-country_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall geolite2-country Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package geolite2-country should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_geolite2-country_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package geolite2-country is removed" test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gnutls-utils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure gnutls-utils is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gnutls-utils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_gnutls-utils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gnutls-utils is installed" test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_gssproxy_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall gssproxy Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package gssproxy should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_gssproxy_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package gssproxy is removed" test_ref="oval:ssg-test_package_gssproxy_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the inet-based telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package inetutils-telnetd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_inetutils-telnetd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_iprutils_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall iprutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package iprutils should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_iprutils_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package iprutils is removed" test_ref="oval:ssg-test_package_iprutils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_iptables_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install iptables Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package iptables should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_iptables_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package iptables is installed" test_ref="oval:ssg-test_package_iptables_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_krb5-workstation_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall krb5-workstation Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package krb5-workstation should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_krb5-workstation_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package krb5-workstation is removed" test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libcap-ng-utils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libcap-ng-utils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libcap-ng-utils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libcap-ng-utils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libcap-ng-utils is installed" test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libreswan_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libreswan Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libreswan should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libreswan_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libreswan is installed" test_ref="oval:ssg-test_package_libreswan_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_libselinux_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install libselinux Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package libselinux should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_libselinux_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package libselinux is installed" test_ref="oval:ssg-test_package_libselinux_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_mcstrans_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall mcstrans Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package mcstrans should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_mcstrans_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package mcstrans is removed" test_ref="oval:ssg-test_package_mcstrans_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_net-snmp_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall net-snmp Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package net-snmp should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_net-snmp_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package net-snmp is removed" test_ref="oval:ssg-test_package_net-snmp_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nfs-utils_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall nfs-utils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nfs-utils should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_nfs-utils_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nfs-utils is removed" test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the nis package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nis should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_nis_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_nss-tools_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure nss-tools is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package nss-tools should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_nss-tools_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package nss-tools is installed" test_ref="oval:ssg-test_package_nss-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the ntp service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ntp should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_ntp_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the ntpdate package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package ntpdate should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_ntpdate_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openldap-clients_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure LDAP client is not installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openldap-clients should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_openldap-clients_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openldap-clients is removed" test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_opensc_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the opensc Package For Multifactor Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package opensc should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_opensc_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package opensc is installed" test_ref="oval:ssg-test_package_opensc_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openscap-scanner_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install openscap-scanner Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openscap-scanner should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_openscap-scanner_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openscap-scanner is installed" test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openssh-server_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssh-server should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_openssh-server_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssh-server is installed" test_ref="oval:ssg-test_package_openssh-server_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the OpenSSH Server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package openssh-server should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_openssh-server_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_pam_ldap_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_pam_ldap_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package pam_ldap should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_pam_ldap_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package pam_ldap is removed" test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_pcsc-lite_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the pcsc-lite package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package pcsc-lite should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_pcsc-lite_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package pcsc-lite is installed" test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_policycoreutils_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install policycoreutils Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package policycoreutils should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_policycoreutils_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package policycoreutils is installed" test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_prelink_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_prelink_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package prelink should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_prelink_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package prelink is removed" test_ref="oval:ssg-test_package_prelink_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rear_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install rear Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rear should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rear_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rear is installed" test_ref="oval:ssg-test_package_rear_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rng-tools_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install rng-tools Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rng-tools should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rng-tools_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rng-tools is installed" test_ref="oval:ssg-test_package_rng-tools_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rsyslog-gnutls_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog-gnutls is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsyslog-gnutls should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rsyslog-gnutls_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rsyslog-gnutls is installed" test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyslog is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package rsyslog should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_rsyslog_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_samba-common_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>package_samba-common_removed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package samba-common should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_samba-common_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package samba-common is removed" test_ref="oval:ssg-test_package_samba-common_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_scap-security-guide_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install scap-security-guide Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package scap-security-guide should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_scap-security-guide_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package scap-security-guide is installed" test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_screen_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the screen Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package screen should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_screen_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package screen is installed" test_ref="oval:ssg-test_package_screen_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sendmail_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall Sendmail Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sendmail should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_sendmail_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sendmail is removed" test_ref="oval:ssg-test_package_sendmail_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-plugins Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot-plugins should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot-plugins_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot-plugins is removed" test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot-server_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot-server Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot-server should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot-server_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot-server is removed" test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_setroubleshoot_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall setroubleshoot Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package setroubleshoot should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_setroubleshoot_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package setroubleshoot is removed" test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sssd-ipa_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install sssd-ipa Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sssd-ipa should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_sssd-ipa_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sssd-ipa is installed" test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_sudo_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install sudo Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package sudo should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_sudo_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package sudo is installed" test_ref="oval:ssg-test_package_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_syslogng_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure syslog-ng is Installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package syslogng should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_syslogng_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package syslogng is installed" test_ref="oval:ssg-test_package_syslogng_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tar_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install tar Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tar should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_tar_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tar is installed" test_ref="oval:ssg-test_package_tar_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the ssl compliant telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package telnetd-ssl should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_telnetd-ssl_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall the telnet server</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package telnetd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_telnetd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tmux_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install the tmux Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tmux should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_tmux_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tmux is installed" test_ref="oval:ssg-test_package_tmux_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_tuned_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall tuned Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package tuned should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_tuned_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package tuned is removed" test_ref="oval:ssg-test_package_tuned_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_usbguard_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install usbguard Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package usbguard should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_usbguard_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package usbguard is installed" test_ref="oval:ssg-test_package_usbguard_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vim_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install vim Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vim-enhanced should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_vim_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vim-enhanced is installed" test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vsftpd_installed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install vsftpd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vsftpd should be installed.</oval-def:description>
            <oval-def:reference ref_id="package_vsftpd_installed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vsftpd is installed" test_ref="oval:ssg-test_package_vsftpd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_vsftpd_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Uninstall vsftpd Package</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package vsftpd should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_vsftpd_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package vsftpd is removed" test_ref="oval:ssg-test_package_vsftpd_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Remove the X Windows Package Group</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The RPM package xorg-x11-server-common should be removed.</oval-def:description>
            <oval-def:reference ref_id="package_xorg-x11-server-common_removed" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="package xorg-x11-server-common is removed" test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_boot:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /boot Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_boot" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testboot_partition:tst:1" comment="/boot on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /home Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_home" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testhome_partition:tst:1" comment="/home on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_opt:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /opt Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_opt" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testopt_partition:tst:1" comment="/opt on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /srv Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_srv" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testsrv_partition:tst:1" comment="/srv on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /tmp Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_tmp" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testtmp_partition:tst:1" comment="/tmp on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_usr:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /usr Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_usr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testusr_partition:tst:1" comment="/usr on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_partition:tst:1" comment="/var on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_log_partition:tst:1" comment="/var/log on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure /var/log/audit Located On Separate Partition</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</oval-def:description>
            <oval-def:reference ref_id="partition_for_var_log_audit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_atd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable At Service (atd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The atd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_atd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package at removed or service atd is not configured to start" operator="OR">
            <oval-def:criterion comment="at removed" test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service atd is not configured to start">
              <oval-def:criterion comment="atd is not running" test_ref="oval:ssg-test_service_not_running_atd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service atd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable auditd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The auditd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_auditd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package audit installed and service auditd is configured to start" operator="AND">
            <oval-def:criterion comment="audit installed" test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1"/>
            <oval-def:criteria comment="service auditd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="auditd is running" test_ref="oval:ssg-test_service_running_auditd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service auditd is configured to start">
                <oval-def:criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants auditd socket" test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_autofs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable the Automounter</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The autofs service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_autofs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package autofs removed or service autofs is not configured to start" operator="OR">
            <oval-def:criterion comment="autofs removed" test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service autofs is not configured to start">
              <oval-def:criterion comment="autofs is not running" test_ref="oval:ssg-test_service_not_running_autofs:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service autofs is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_bluetooth_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Bluetooth Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The bluetooth service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_bluetooth_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package bluez removed or service bluetooth is not configured to start" operator="OR">
            <oval-def:criterion comment="bluez removed" test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service bluetooth is not configured to start">
              <oval-def:criterion comment="bluetooth is not running" test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service bluetooth is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_chronyd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>The Chronyd service is enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The chronyd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_chronyd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package chrony installed and service chronyd is configured to start" operator="AND">
            <oval-def:criterion comment="chrony installed" test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1"/>
            <oval-def:criteria comment="service chronyd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="chronyd is running" test_ref="oval:ssg-test_service_running_chronyd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service chronyd is configured to start">
                <oval-def:criterion comment="multi-user.target wants chronyd" test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants chronyd socket" test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_cron_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable cron Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The cron service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_cron_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package cron installed and service cron is configured to start" operator="AND">
            <oval-def:criterion comment="cron installed" test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1"/>
            <oval-def:criteria comment="service cron is configured to start and is running" operator="AND">
              <oval-def:criterion comment="cron is running" test_ref="oval:ssg-test_service_running_cron:tst:1"/>
              <oval-def:criteria operator="OR" comment="service cron is configured to start">
                <oval-def:criterion comment="multi-user.target wants cron" test_ref="oval:ssg-test_multi_user_wants_cron:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants cron socket" test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_crond_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable cron Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The crond service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_crond_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package cronie installed and service crond is configured to start" operator="AND">
            <oval-def:criterion comment="cronie installed" test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1"/>
            <oval-def:criteria comment="service crond is configured to start and is running" operator="AND">
              <oval-def:criterion comment="crond is running" test_ref="oval:ssg-test_service_running_crond:tst:1"/>
              <oval-def:criteria operator="OR" comment="service crond is configured to start">
                <oval-def:criterion comment="multi-user.target wants crond" test_ref="oval:ssg-test_multi_user_wants_crond:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants crond socket" test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_debug-shell_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable debug-shell SystemD Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The debug-shell service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_debug-shell_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd removed or service debug-shell is not configured to start" operator="OR">
            <oval-def:criterion comment="systemd removed" test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service debug-shell is not configured to start">
              <oval-def:criterion comment="debug-shell is not running" test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service debug-shell is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_firewalld_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify firewalld Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The firewalld service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_firewalld_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package firewalld installed and service firewalld is configured to start" operator="AND">
            <oval-def:criterion comment="firewalld installed" test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1"/>
            <oval-def:criteria comment="service firewalld is configured to start and is running" operator="AND">
              <oval-def:criterion comment="firewalld is running" test_ref="oval:ssg-test_service_running_firewalld:tst:1"/>
              <oval-def:criteria operator="OR" comment="service firewalld is configured to start">
                <oval-def:criterion comment="multi-user.target wants firewalld" test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants firewalld socket" test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ip6tables_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify ip6tables Enabled if Using IPv6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ip6tables service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ip6tables_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables-ipv6 installed and service ip6tables is configured to start" operator="AND">
            <oval-def:criterion comment="iptables-ipv6 installed" test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1"/>
            <oval-def:criteria comment="service ip6tables is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ip6tables is running" test_ref="oval:ssg-test_service_running_ip6tables:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ip6tables is configured to start">
                <oval-def:criterion comment="multi-user.target wants ip6tables" test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ip6tables socket" test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_iptables_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify iptables Enabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The iptables service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_iptables_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package iptables installed and service iptables is configured to start" operator="AND">
            <oval-def:criterion comment="iptables installed" test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1"/>
            <oval-def:criteria comment="service iptables is configured to start and is running" operator="AND">
              <oval-def:criterion comment="iptables is running" test_ref="oval:ssg-test_service_running_iptables:tst:1"/>
              <oval-def:criteria operator="OR" comment="service iptables is configured to start">
                <oval-def:criterion comment="multi-user.target wants iptables" test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants iptables socket" test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_netfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File Systems (netfs)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The netfs service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_netfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package netfs removed or service netfs is not configured to start" operator="OR">
            <oval-def:criterion comment="netfs removed" test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service netfs is not configured to start">
              <oval-def:criterion comment="netfs is not running" test_ref="oval:ssg-test_service_not_running_netfs:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service netfs is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_nfs_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File System (nfs)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nfs-server service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_nfs_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service nfs-server is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service nfs-server is not configured to start">
              <oval-def:criterion comment="nfs-server is not running" test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service nfs-server is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_nfslock_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Network File System Lock Service (nfslock)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The nfslock service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_nfslock_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service nfslock is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service nfslock is not configured to start">
              <oval-def:criterion comment="nfslock is not running" test_ref="oval:ssg-test_service_not_running_nfslock:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service nfslock is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ntp_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ntp service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ntp_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package ntp installed and service ntp is configured to start" operator="AND">
            <oval-def:criterion comment="ntp installed" test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1"/>
            <oval-def:criteria comment="service ntp is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ntp is running" test_ref="oval:ssg-test_service_running_ntp:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ntp is configured to start">
                <oval-def:criterion comment="multi-user.target wants ntp" test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ntp socket" test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the NTP Daemon</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The ntpd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_ntpd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">
            <oval-def:criterion comment="ntp installed" test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1"/>
            <oval-def:criteria comment="service ntpd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="ntpd is running" test_ref="oval:ssg-test_service_running_ntpd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service ntpd is configured to start">
                <oval-def:criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants ntpd socket" test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_pcscd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the pcscd Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The pcscd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_pcscd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package pcsc-lite installed and service pcscd is configured to start" operator="AND">
            <oval-def:criterion comment="pcsc-lite installed" test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1"/>
            <oval-def:criteria comment="service pcscd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="pcscd is running" test_ref="oval:ssg-test_service_running_pcscd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service pcscd is configured to start">
                <oval-def:criterion comment="multi-user.target wants pcscd" test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants pcscd socket" test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rngd_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the Hardware RNG Entropy Gatherer Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rngd service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rngd_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rng-tools installed and service rngd is configured to start" operator="AND">
            <oval-def:criterion comment="rng-tools installed" test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1"/>
            <oval-def:criteria comment="service rngd is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rngd is running" test_ref="oval:ssg-test_service_running_rngd:tst:1"/>
              <oval-def:criteria operator="OR" comment="service rngd is configured to start">
                <oval-def:criterion comment="multi-user.target wants rngd" test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rngd socket" test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcgssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Secure RPC Client Service (rpcgssd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcgssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcgssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcgssd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcgssd is not configured to start">
              <oval-def:criterion comment="rpcgssd is not running" test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcgssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable RPC ID Mapping Service (rpcidmapd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcidmapd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcidmapd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcidmapd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcidmapd is not configured to start">
              <oval-def:criterion comment="rpcidmapd is not running" test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcidmapd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Secure RPC Server Service (rpcsvcgssd)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rpcsvcgssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rpcsvcgssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package nfs-utils removed or service rpcsvcgssd is not configured to start" operator="OR">
            <oval-def:criterion comment="nfs-utils removed" test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rpcsvcgssd is not configured to start">
              <oval-def:criterion comment="rpcsvcgssd is not running" test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rpcsvcgssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rsyncd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure rsyncd service is diabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rsyncd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rsyncd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsync-daemon removed or service rsyncd is not configured to start" operator="OR">
            <oval-def:criterion comment="rsync-daemon removed" test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service rsyncd is not configured to start">
              <oval-def:criterion comment="rsyncd is not running" test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service rsyncd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable rsyslog Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The rsyslog service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_rsyslog_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">
            <oval-def:criterion comment="rsyslog installed" test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1"/>
            <oval-def:criteria comment="service rsyslog is configured to start and is running" operator="AND">
              <oval-def:criterion comment="rsyslog is running" test_ref="oval:ssg-test_service_running_rsyslog:tst:1"/>
              <oval-def:criteria operator="OR" comment="service rsyslog is configured to start">
                <oval-def:criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants rsyslog socket" test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Server If Possible (Unusual)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sshd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_sshd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">
            <oval-def:criterion comment="openssh-server removed" test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service sshd is not configured to start">
              <oval-def:criterion comment="sshd is not running" test_ref="oval:ssg-test_service_not_running_sshd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service sshd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_sssd_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>service_sssd_disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The sssd service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_sssd_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package sssd-common removed or service sssd is not configured to start" operator="OR">
            <oval-def:criterion comment="sssd-common removed" test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service sssd is not configured to start">
              <oval-def:criterion comment="sssd is not running" test_ref="oval:ssg-test_service_not_running_sssd:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service sssd is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_syslog_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>service_syslog_disabled</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The syslog service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_syslog_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package rsyslog removed or service syslog is not configured to start" operator="OR">
            <oval-def:criterion comment="rsyslog removed" test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service syslog is not configured to start">
              <oval-def:criterion comment="syslog is not running" test_ref="oval:ssg-test_service_not_running_syslog:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service syslog is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_syslogng_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable syslog-ng Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The syslogng service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_syslogng_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package syslogng installed and service syslogng is configured to start" operator="AND">
            <oval-def:criterion comment="syslogng installed" test_ref="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1"/>
            <oval-def:criteria comment="service syslogng is configured to start and is running" operator="AND">
              <oval-def:criterion comment="syslogng is running" test_ref="oval:ssg-test_service_running_syslogng:tst:1"/>
              <oval-def:criteria operator="OR" comment="service syslogng is configured to start">
                <oval-def:criterion comment="multi-user.target wants syslogng" test_ref="oval:ssg-test_multi_user_wants_syslogng:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants syslogng socket" test_ref="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_systemd-coredump_disabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable acquiring, saving, and processing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The systemd-coredump service should be disabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_systemd-coredump_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package systemd removed or service systemd-coredump is not configured to start" operator="OR">
            <oval-def:criterion comment="systemd removed" test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1"/>
            <oval-def:criteria operator="AND" comment="service systemd-coredump is not configured to start">
              <oval-def:criterion comment="systemd-coredump is not running" test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1"/>
              <oval-def:criterion comment="Property LoadState of service systemd-coredump is masked" test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-service_usbguard_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable the USBGuard Service</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The usbguard service should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="service_usbguard_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package usbguard installed and service usbguard is configured to start" operator="AND">
            <oval-def:criterion comment="usbguard installed" test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1"/>
            <oval-def:criteria comment="service usbguard is configured to start and is running" operator="AND">
              <oval-def:criterion comment="usbguard is running" test_ref="oval:ssg-test_service_running_usbguard:tst:1"/>
              <oval-def:criteria operator="OR" comment="service usbguard is configured to start">
                <oval-def:criterion comment="multi-user.target wants usbguard" test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1"/>
                <oval-def:criterion comment="multi-user.target wants usbguard socket" test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Access via Empty Passwords</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_empty_passwords" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of PermitEmptyPasswords in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of PermitEmptyPasswords in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_gssapi_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of GSSAPIAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable Kerberos Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_kerb_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the KerberosAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of KerberosAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of KerberosAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the KerberosAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_pubkey_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable PubkeyAuthentication Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_pubkey_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1"/>
                <oval-def:criterion comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_rhosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for .rhosts Files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_rhosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of IgnoreRhosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of IgnoreRhosts in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the IgnoreRhosts in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_root_login:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Root Login</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_root_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_root_login:tst:1"/>
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_root_password_login:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH root Login with a Password (Insecure)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_root_password_login" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of PermitRootLogin in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of PermitRootLogin in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_tcp_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH TCP Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_tcp_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1"/>
                <oval-def:criterion comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable SSH Support for User Known Hosts</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_user_known_hosts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1"/>
                <oval-def:criterion comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_disable_x11_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Disable X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_disable_x11_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of X11Forwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Do Not Allow SSH Environment Options</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_do_not_permit_user_env" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of PermitUserEnvironment in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of PermitUserEnvironment in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_gssapi_auth:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable GSSAPI Authentication</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_gssapi_auth" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1"/>
                <oval-def:criterion comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_strictmodes:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Use of Strict Mode Checking</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_strictmodes" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the StrictModes in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of StrictModes in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of StrictModes in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the StrictModes in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_warning_banner:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Warning Banner</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_warning_banner" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1"/>
                <oval-def:criterion comment="Check the Banner in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_enable_x11_forwarding:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Encrypted X11 Forwarding</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_enable_x11_forwarding" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1"/>
                <oval-def:criterion comment="Check the X11Forwarding in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_includes_config_files:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>sshd_includes_config_files</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config</oval-def:description>
            <oval-def:reference ref_id="sshd_includes_config_files" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 0 extra definitions.">
            <oval-def:criterion comment="Check that /etc/ssh/sshd_config contains a line with certain text" test_ref="oval:ssg-test_sshd_includes_config_files:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_print_last_log:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable SSH Print Last Log</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_print_last_log" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the PrintLastLog in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_print_last_log:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of PrintLastLog in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of PrintLastLog in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the PrintLastLog in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_keepalive_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Client Alive Count Max to zero</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_keepalive_0" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1"/>
                <oval-def:criterion comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_loglevel_info:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set LogLevel to INFO</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_loglevel_info" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_set_loglevel_verbose:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Set SSH Daemon LogLevel to VERBOSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_set_loglevel_verbose" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of LogLevel in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the LogLevel in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_x11_use_localhost:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Prevent remote hosts from connecting to the proxy display</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Ensure 'X11UseLocalhost' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</oval-def:description>
            <oval-def:reference ref_id="sshd_x11_use_localhost" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="sshd is configured correctly or is not installed" operator="OR">
            <oval-def:criteria comment="sshd is not installed" operator="AND">
              <oval-def:extend_definition comment="sshd is not required or requirement is unset" definition_ref="oval:ssg-sshd_not_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>
            </oval-def:criteria>
            <oval-def:criteria comment="sshd is installed and configured" operator="AND">
              <oval-def:extend_definition comment="sshd is required or requirement is unset" definition_ref="oval:ssg-sshd_required_or_unset:def:1"/>
              <oval-def:extend_definition comment="rpm package openssh-server installed" definition_ref="oval:ssg-package_openssh-server_installed:def:1"/>
              <oval-def:criteria comment="sshd is configured correctly" operator="OR">
                <oval-def:criterion comment="Check the X11UseLocalhost in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1"/>
                <oval-def:criteria comment="sshd is not configured incorrectly" operator="AND">
                  <oval-def:criterion comment="Check the absence of X11UseLocalhost in /etc/ssh/sshd_config" test_ref="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1"/>
                  <oval-def:criterion comment="Check the absence of X11UseLocalhost in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1"/>
                </oval-def:criteria>
                <oval-def:criterion comment="Check the X11UseLocalhost in /etc/ssh/sshd_config.d" test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_enable_certmap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable Certmap in SSSD</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check presence of ^\[certmap\/.+\/.+\]$ in /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="sssd_enable_certmap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND" comment="Test conditions - presence of the file plus 0 extra definitions.">
            <oval-def:criterion comment="Check that /etc/sssd/sssd.conf contains a line with certain text" test_ref="oval:ssg-test_sssd_enable_certmap:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_noexec:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_noexec" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="noexec is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_noexec_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_requiretty:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_requiretty" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="requiretty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_requiretty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_add_use_pty:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_add_use_pty" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="use_pty is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_use_pty_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sudo_custom_logfile:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ensure Sudo Logfile Exists - sudo logfile</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks sudoers Defaults {{ OPTION }} configuration</oval-def:description>
            <oval-def:reference ref_id="sudo_custom_logfile" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="logfile is configured in /etc/sudoers or /etc/sudoers.d/" test_ref="oval:ssg-test_logfile_sudoers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>
            <oval-def:extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_hardlinks' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>
            <oval-def:extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Enforce DAC on Symlinks</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.protected_symlinks' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>
            <oval-def:extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Core Dumps for SUID programs</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'fs.suid_dumpable' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>
            <oval-def:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.core_pattern configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1"/>
            <oval-def:extend_definition comment="kernel.core_pattern runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to '|/bin/false'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable storing core dumps</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.core_pattern' parameter should be set to '|/bin/false'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_core_pattern" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.core_pattern set to |/bin/false in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>
            <oval-def:extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Access to Kernel Message Buffer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.dmesg_restrict' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kexec_load_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.kexec_load_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Image Loading</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kexec_load_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_kexec_load_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>
            <oval-def:extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict Exposed Kernel Pointer Addresses Access</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.kptr_restrict' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.modules_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.modules_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.modules_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.modules_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable loading and unloading of kernel modules</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.modules_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_modules_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.modules_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_cpu_time_max_percent' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit CPU consumption of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_event_max_sample_rate' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Limit sampling frequency of the Perf system</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>
            <oval-def:extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow kernel profiling by unprivileged users</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.perf_event_paranoid' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.pid_max' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>
            <oval-def:extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to '65536'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure maximum number of process identifiers</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.pid_max' parameter should be set to '65536'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_pid_max" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>
            <oval-def:extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Randomized Layout of Virtual Address Space</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.randomize_va_space' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.sysrq' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>
            <oval-def:extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disallow magic SysRq key</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.sysrq' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_sysrq" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1"/>
            <oval-def:extend_definition comment="kernel.unprivileged_bpf_disabled runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_unprivileged_bpf_disabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1"/>
            <oval-def:extend_definition comment="kernel.yama.ptrace_scope runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Restrict usage of ptrace to descendant processes</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_kernel_yama_ptrace_scope" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1"/>
            <oval-def:criterion comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.core.bpf_jit_harden configuration setting check" definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1"/>
            <oval-def:extend_definition comment="net.core.bpf_jit_harden runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Harden the operation of the BPF just-in-time compiler</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.core.bpf_jit_harden' parameter should be set to '2'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_core_bpf_jit_harden" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.all.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_all_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.accept_source_route runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.log_martians runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_log_martians" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.rp_filter runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_rp_filter" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.secure_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.conf.default.send_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_conf_default_send_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_forward set to 0" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_forward' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_ip_forward" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_forward set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.ip_local_port_range' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.ip_local_port_range runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to '32768 65535'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Set Kernel Parameter to Increase Local Port Range</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to '32768 65535'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_ip_local_port_range" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1"/>
            <oval-def:extend_definition comment="net.ipv4.tcp_syncookies runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv4_tcp_syncookies" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_all_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_defrtr set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_defrtr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_defrtr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_pinfo set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_pinfo runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_pinfo" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_rtr_pref set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_ra_rtr_pref runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.accept_redirects runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.autoconf set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.autoconf runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Auto Configuration on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_autoconf" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.disable_ipv6 set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to '1'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_disable_ipv6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.max_addresses set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.max_addresses runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_max_addresses" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" version="4">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.default.router_solicitations set correctly" operator="OR">
            <oval-def:extend_definition comment="is IPv6 enabled?" definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1"/>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.default.router_solicitations runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description> the appropriate value in the system configuration.</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_net_ipv6_conf_default_router_solicitations" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
            <oval-def:criterion comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="user.max_user_namespaces configuration setting check" definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1"/>
            <oval-def:extend_definition comment="user.max_user_namespaces runtime setting check" definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter user.max_user_namespaces set to 0" test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Disable the use of user namespaces</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'user.max_user_namespaces' parameter should be set to '0'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_user_max_user_namespaces" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1"/>
            <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1"/>
            <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1"/>
            <oval-def:criterion comment="kernel static parameter user.max_user_namespaces set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The 'vm.mmap_min_addr' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</oval-def:description>
            <oval-def:reference ref_id="sysctl_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="vm.mmap_min_addr configuration setting check" definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1"/>
            <oval-def:extend_definition comment="vm.mmap_min_addr runtime setting check" definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to '65536'</oval-def:description>
            <oval-def:reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Prevent applications from mapping low portion of virtual memory</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The kernel 'vm.mmap_min_addr' parameter should be set to '65536'</oval-def:description>
            <oval-def:reference ref_id="sysctl_static_vm_mmap_min_addr" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1"/>
            <oval-def:criterion comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-timer_dnf-automatic_enabled:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Enable dnf-automatic Timer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The dnf-automatic timer should be enabled if possible.</oval-def:description>
            <oval-def:reference ref_id="timer_dnf-automatic_enabled" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="package dnf-automatic installed and timer dnf-automatic is configured to start" operator="AND">
            <oval-def:extend_definition comment="dnf-automatic installed" definition_ref="oval:ssg-package_dnf-automatic_installed:def:1"/>
            <oval-def:criteria comment="timer dnf-automatic is configured to start and is running" operator="AND">
              <oval-def:criterion comment="dnf-automatic is running" test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1"/>
              <oval-def:criterion comment="multi-user.target wants dnf-automatic" test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_faillock:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check pam_faillock Existence in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that pam_faillock.so exists in system-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_faillock" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions for pam_faillock are satisfied" test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check pam_pwquality Existence in system-auth</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that pam_pwquality.so exists in system-auth</oval-def:description>
            <oval-def:reference ref_id="accounts_password_pam_pwquality" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Conditions for pam_pwquality are satisfied" test_ref="oval:ssg-test_password_pam_pwquality:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_auditctl:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if auditctl is in use for audit rules.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_auditctl" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="audit auditctl" test_ref="oval:ssg-test_audit_rules_auditctl:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_augenrules:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Any Attempts to Run semanage</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if augenrules is enabled for audit rules.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_augenrules" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="audit augenrules" test_ref="oval:ssg-test_audit_rules_augenrules:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_domainname" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit setdomainname" test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit setdomainname" test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Record Events that Modify the System's Network Environment</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</oval-def:description>
            <oval-def:reference ref_id="audit_rules_networkconfig_modification_hostname" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit augenrules" definition_ref="oval:ssg-audit_rules_augenrules:def:1"/>
              <oval-def:criterion comment="audit augenrules 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit augenrules 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="audit auditctl" definition_ref="oval:ssg-audit_rules_auditctl:def:1"/>
              <oval-def:criterion comment="audit auditctl 32-bit sethostname" test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1"/>
              <oval-def:criteria operator="OR">
                <oval-def:extend_definition comment="64-bit system" definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true"/>
                <oval-def:criterion comment="audit auditctl 64-bit sethostname" test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</oval-def:description>
            <oval-def:reference ref_id="auditd_conf_log_group_not_root" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
            <oval-def:criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" comment="Verify 'log_group' is set in /etc/audit/auditd.conf"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify GRUB_DISABLE_RECOVERY Set to true</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</oval-def:description>
            <oval-def:reference ref_id="bootloader_disable_recovery_set_to_true" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Specify Multiple Remote chronyd NTP Servers for Time Data</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Multiple chronyd NTP Servers for time synchronization should be specified.</oval-def:description>
            <oval-def:reference ref_id="chronyd_specify_multiple_servers" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="chrony.conf conditions are met">
            <oval-def:criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-grub2_default_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>GRUB_CMDLINE_LINUX_DEFAULT existance check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub.</oval-def:description>
            <oval-def:reference ref_id="grub2_default_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-install_mcafee_hbss:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</oval-def:description>
            <oval-def:reference ref_id="install_mcafee_hbss" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_cma_rt:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1"/>
            <oval-def:extend_definition comment="McAfee HBSS" definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos8:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_centos8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS" test_ref="oval:ssg-test_centos8_name:tst:1"/>
            <oval-def:criterion comment="OS version is 8" test_ref="oval:ssg-test_centos8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Debian</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is a Debian System</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Debian" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian10:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 10</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian10" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 10" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian10 is installed" test_ref="oval:ssg-test_debian_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian9:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_debian9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Debian version is Debian Stretch" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian9 is installed" test_ref="oval:ssg-test_debian_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is Fedora</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:33" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:34" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:35" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Fedora</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_fedora" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="fedora-release RPM packages are installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
            <oval-def:criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ol7_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 7 System is installed" test_ref="oval:ssg-test_ol7_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ol8_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 8 System is installed" test_ref="oval:ssg-test_ol8_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is openSUSE.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="openSUSE is installed" test_ref="oval:ssg-test_opensuse_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:15.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 15.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse_leap15" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 15 is installed" test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 42</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.1" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.2" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 42.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_opensuse_leap42" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 42 is installed" test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_part_of_Unix_family" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux CoreOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux_coreos:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhcos4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="RHCOS is installed" test_ref="oval:ssg-test_rhcos:tst:1"/>
              <oval-def:criterion comment="RHCOS version 4 is installed" test_ref="oval:ssg-test_rhcos4:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 7 Client is installed" test_ref="oval:ssg-test_rhel7_client:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 7" test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel8_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 8 is installed" test_ref="oval:ssg-test_rhel8:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 8" test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_0" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.0 is installed" test_ref="oval:ssg-test_rhel8_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.1" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_1" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.1 is installed" test_ref="oval:ssg-test_rhel8_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.2" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_2" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.2 is installed" test_ref="oval:ssg-test_rhel8_2:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_3" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.3 is installed" test_ref="oval:ssg-test_rhel8_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.4 is installed" test_ref="oval:ssg-test_rhel8_4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.5</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.5" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_5" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.5 is installed" test_ref="oval:ssg-test_rhel8_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.6 is installed" test_ref="oval:ssg-test_rhel8_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.7 is installed" test_ref="oval:ssg-test_rhel8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.8 is installed" test_ref="oval:ssg-test_rhel8_8:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.9 is installed" test_ref="oval:ssg-test_rhel8_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel8_10" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.10 is installed" test_ref="oval:ssg-test_rhel8_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhel9" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel9_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 9 is installed" test_ref="oval:ssg-test_rhel9:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 9" test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_rhv4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="RHEL8 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 6</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sl6" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 7</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sl7" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle12:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 12</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:12" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:12" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sle12" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle12_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 12 Desktop is installed" test_ref="oval:ssg-test_sle12_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 12 Server is installed" test_ref="oval:ssg-test_sle12_server:tst:1"/>
              <oval-def:criterion comment="SLES 12 for SAP Applications is installed" test_ref="oval:ssg-test_sles_12_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:15" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:15" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_sle15" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle15_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 15 Desktop is installed" test_ref="oval:ssg-test_sle15_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 15 Server is installed" test_ref="oval:ssg-test_sle15_server:tst:1"/>
              <oval-def:criterion comment="SLES 15 for SAP Applications is installed" test_ref="oval:ssg-test_sles_15_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is an Ubuntu System</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Ubuntu" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>
            <oval-def:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1604</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1604</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1604" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Xenial" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1804</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:18.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1804</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu1804" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Bionic" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Bionic is installed" test_ref="oval:ssg-test_ubuntu_bionic:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 2004</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:20.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 2004</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_ubuntu2004" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Focal" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Focal is installed" test_ref="oval:ssg-test_ubuntu_focal:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 1019</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 1019</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_wrlinux1019" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux1019:tst:1"/>
            <oval-def:criterion comment="Produce name is WRLinux" test_ref="oval:ssg-test_wrlinux1019_name:tst:1"/>
            <oval-def:criterion comment="WRLinux version is 1019" test_ref="oval:ssg-test_wrlinux1019_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 8</oval-def:description>
            <oval-def:reference ref_id="installed_OS_is_wrlinux8" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="current WRLinux version is WRLinux8" operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux8:tst:1"/>
            <oval-def:criterion comment="WRLinux 8 is installed" test_ref="oval:ssg-test_wrlinux8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhosp10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat OpenStack Platform</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:openstack:10" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat OpenStack Platform 10.</oval-def:description>
            <oval-def:reference ref_id="installed_app_is_rhosp10" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="OpenStack is installed" test_ref="oval:ssg-test_rhosp10_release:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhosp13:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat OpenStack Platform</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:openstack:13.0" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat OpenStack Platform 13.</oval-def:description>
            <oval-def:reference ref_id="installed_app_is_rhosp13" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="OpenStack is installed" test_ref="oval:ssg-test_rhosp13_release:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat Virtualization 4.</oval-def:description>
            <oval-def:reference ref_id="installed_app_is_rhv4" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Manager (RHVM)" test_ref="oval:ssg-test_rhevm4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_audit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package audit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package audit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:audit" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_audit_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package audit is installed" test_ref="oval:ssg-test_env_has_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_chrony_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package chrony is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package chrony is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:chrony" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_chrony_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package chrony is installed" test_ref="oval:ssg-test_env_has_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_gdm_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package gdm is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package gdm is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:gdm" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_gdm_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package gdm is installed" test_ref="oval:ssg-test_env_has_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_grub2_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package grub2 is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package grub2-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:grub2" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_grub2_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Package grub2-common is installed" test_ref="oval:ssg-test_env_has_grub2_installed:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true"/>
              <oval-def:criterion comment="Test if OPAL is not used" test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_libuser_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package libuser is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package libuser is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:libuser" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_libuser_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package libuser is installed" test_ref="oval:ssg-test_env_has_libuser_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package providing /etc/login.defs is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package providing /etc/login.defs and is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:login_defs" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_login_defs" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package providing /etc/login.defs is installed" test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package net-snmp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:net-snmp" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_net-snmp_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package net-snmp is installed" test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package nss-pam-ldapd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package nss-pam-ldapd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:nss-pam-ldapd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_nss-pam-ldapd_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package nss-pam-ldapd is installed" test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ntp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package ntp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package ntp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ntp" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_ntp_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package ntp is installed" test_ref="oval:ssg-test_env_has_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_pam_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package pam is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package pam is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:pam" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_pam_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package pam is installed" test_ref="oval:ssg-test_env_has_pam_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_postfix_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package postfix is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package postfix is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:postfix" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_postfix_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package postfix is installed" test_ref="oval:ssg-test_env_has_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sssd-common is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sssd-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_sssd-common_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sssd-common is installed" test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sudo_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sudo is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sudo is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sudo" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_sudo_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sudo is installed" test_ref="oval:ssg-test_env_has_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_systemd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package systemd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package systemd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:systemd" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_systemd_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package systemd is installed" test_ref="oval:ssg-test_env_has_systemd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_yum_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package yum is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package yum is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:yum" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_yum_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package yum is installed" test_ref="oval:ssg-test_env_has_yum_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_zipl_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System uses zIPL</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if system uses zIPL bootloader.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:zipl" source="CPE"/>
            <oval-def:reference ref_id="installed_env_has_zipl_package" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package s390utils-base is installed" test_ref="oval:ssg-test_env_has_zipl_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_container:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a container</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for presence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:container" source="CPE"/>
            <oval-def:reference ref_id="installed_env_is_a_container" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check if /.dockerenv exists" test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1"/>
            <oval-def:criterion comment="Check if /run/.containerenv exists" test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_machine:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a machine</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for absence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:machine" source="CPE"/>
            <oval-def:reference ref_id="installed_env_is_a_machine" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="If environment is not a container, it is machine" definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>No CD/DVD drive is configured to automount in /etc/fstab</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check the /etc/fstab and check if a CD/DVD drive
      is not configured for automount.</oval-def:description>
            <oval-def:reference ref_id="no_cd_dvd_drive_in_etc_fstab" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" comment="Check if CD/DVD drive is not configured to automout in /etc/fstab"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_not_s390x" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not s390x" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</oval-def:description>
            <oval-def:reference ref_id="proc_sys_kernel_osrelease_arch_s390x" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is s390x" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Device Files for Removable Media Partitions Does Not Exist on the System</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify if device file representing removable partitions
      exist on the system</oval-def:description>
            <oval-def:reference ref_id="removable_partition_doesnt_exist" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_not_required_or_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSHD is not required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good.</oval-def:description>
            <oval-def:reference ref_id="sshd_not_required_or_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH not required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_not_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_required_or_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSHD is required to be installed or requirement not set</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>If SSHD is required, we check it is installed. If SSH requirement is unset, we are good.</oval-def:description>
            <oval-def:reference ref_id="sshd_required_or_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="SSH required or not set" operator="OR">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_required:tst:1"/>
            <oval-def:extend_definition comment="SSH requirement is unset" definition_ref="oval:ssg-sshd_requirement_unset:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_requirement_unset:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>It doesn't matter if sshd is installed or not</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Test if value sshd_required is 0.</oval-def:description>
            <oval-def:reference ref_id="sshd_requirement_unset" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>OpenSSH Server is 7.4 or newer</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if version of OpenSSH Server is equal or higher than 7.4</oval-def:description>
            <oval-def:reference ref_id="sshd_version_equal_or_higher_than_74" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="OpenSSH Server version is equal or higher than 7.4" operator="OR">
            <oval-def:criterion comment="Check if OpenSSH Server is equal or higher than 7.4" test_ref="oval:ssg-test_openssh-server_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sssd_conf_exists:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Verify The SSSD Configuration File Exists</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The /etc/sssd/sssd.conf file should exist if it is
      in use.</oval-def:description>
            <oval-def:reference ref_id="sssd_conf_exists" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Check if sssd_conf_exists" test_ref="oval:ssg-test_sssd_conf_exists:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSSD is configured to use LDAP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Identification provider is not set to ad within /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd-ldap" source="CPE"/>
            <oval-def:reference ref_id="sssd_conf_uses_ldap" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Identification provider is not set to ad within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Kernel Runtime Parameter IPv6 Check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Disables IPv6 for all network interfaces.</oval-def:description>
            <oval-def:reference ref_id="sysctl_kernel_ipv6_disable" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly" operator="OR">
            <oval-def:criteria operator="AND">
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1"/>
              <oval-def:extend_definition comment="net.ipv6.conf.all.disable_ipv6 runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Non-UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if System boot mode is non-UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:non-uefi" source="CPE"/>
            <oval-def:reference ref_id="system_boot_mode_is_non_uefi" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if system boot mode is UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:uefi" source="CPE"/>
            <oval-def:reference ref_id="system_boot_mode_is_uefi" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_64bit:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for 64-bit Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for 64-bit architectures to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_64bit" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="Generic test for x86_64 architecture" definition_ref="oval:ssg-system_info_architecture_x86_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for ppc64 architecture" definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for aarch64 architecture" definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1"/>
            <oval-def:extend_definition comment="Generic test for s390x architecture" definition_ref="oval:ssg-system_info_architecture_s390_64:def:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_aarch_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for aarch_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for aarch_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_aarch_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for aarch_64 architecture" test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for PPC and PPCLE Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for PPC PPC64LE architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_ppc_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Generic test for ppc64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1"/>
            <oval-def:criterion comment="Generic test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_s390_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for s390_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for s390_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_s390_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for s390_64 architecture" test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_x86:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for x86 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for x86 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_x86" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for x86 architecture" test_ref="oval:ssg-test_system_info_architecture_x86:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-system_info_architecture_x86_64:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for x86_64 Architecture</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Generic test for x86_64 architecture to be used by other tests</oval-def:description>
            <oval-def:reference ref_id="system_info_architecture_x86_64" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Generic test for x86_64 architecture" test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Check that file storing USBGuard rules exists and is not empty</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty</oval-def:description>
            <oval-def:reference ref_id="usbguard_rules_not_empty_not_missing" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria comment="Check that file storing USBGuard rules exists and is not empty" operator="AND">
            <oval-def:criterion comment="Check that the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non white space character." test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Value of 'var_accounts_user_umask' variable represented as octal number</oval-def:description>
            <oval-def:reference ref_id="var_accounts_user_umask_as_number" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</oval-def:description>
            <oval-def:reference ref_id="var_removable_partition_is_cd_dvd_drive" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="compliance" id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Value of 'var_umask_for_daemons' variable represented as octal number</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Value of 'var_umask_for_daemons' variable represented as octal number</oval-def:description>
            <oval-def:reference ref_id="var_umask_for_daemons_as_number" source="ssg"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="log ftp transactions" id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Banner for FTP Users" id="oval:ssg-test_ftp_present_banner:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" check="all" check_existence="none_exist" version="1" comment="Ensure keytab file does not exist">
          <unix:object object_ref="oval:ssg-obj_kerberos_disable_no_keytab:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check if root has the correct mail alias." id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_root_mail_alias:obj:1"/>
          <ind:state state_ref="oval:ssg-state_root_mail_alias:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the insecure locks in /etc/exports" id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_port_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_port_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_cmdport_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_cmdport_value_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if maxpoll is set in /etc/ntp.conf" id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if maxpoll is set in /etc/chrony.conf" id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chrony_set_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if all server entries have maxpoll set in /etc/ntp.conf" id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if all server entries have maxpoll set in /etc/chrony.conf" id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1"/>
          <ind:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of OPTIONS setting in the /etc/sysconfig/chronyd file" id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1"/>
          <ind:state state_ref="oval:ssg-state_chronyd_run_as_chrony_user:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user" version="1">
          <unix:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one NTP server is set" id="oval:ssg-test_chronyd_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="ensure ipv4 restrictions" id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="ensure ipv6 restrictions" id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" comment="check /etc/sysconfig/ntpd">
          <ind:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" comment="check /usr/lib/systemd/system/ntpd.service">
          <ind:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-test_ntp_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts in /root" id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .rhosts in /home" id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for /etc/hosts.equiv" id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_default_communities:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Check snmpd configuration" id="oval:ssg-test_snmp_versions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="sshd uses protocol 2" id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_compression:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_compression:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of RekeyLimit setting in the  file" id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_rekey_limit:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="timeout is configured" id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="maxauthtries is configured" id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_max_auth_tries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxauthtries_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="maxsessions is configured" id="oval:ssg-test_sshd_max_sessions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_max_sessions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_maxsessions_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" comment="SSH MaxStartups start parameter is less than or equal to 10">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" comment="SSH MaxStartups rate parameter is greater than or equal to 30">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" comment="SSH MaxStartups full parameter is less than or equal to 100">
          <ind:object object_ref="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of match setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_use_priv_separation:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="test the value of         certificate_verification in sssd configuration" id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_certificate_verification:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_certificate_verification:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_smartcards:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of memcache_timeout setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_memcache_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_memcache_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" comment="tests the value of user setting in SSSD config files" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_user_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_user_value:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file" id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_usbguard_auditbackend:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend" version="1">
          <unix:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1"/>
        </unix:file_test>
        <unix:symlink_test check="all" check_existence="all_exist" comment="default.target systemd softlink exists" id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_disable_xwindows_runlevel_target:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_xwindows_runlevel_target:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test check="at least one" check_existence="at_least_one_exists" comment="correct banner in /etc/issue" id="oval:ssg-test_banner_etc_issue:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_issue:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="correct banner in /etc/motd" id="oval:ssg-test_banner_etc_motd:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_banner_etc_motd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_banner_etc_motd:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner is enabled" id="oval:ssg-test_banner_gui_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI banner cannot be changed by user" id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="login banner text is correctly set" id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check the pam_lastlog configuration" id="oval:ssg-test_display_login_attempts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Forbid 'silent' option for pam_lastlog" id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_display_login_attempts_silent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of pam_namespace.so module in the /etc/pam.d/login file" id="oval:ssg-test_enable_pam_namespace:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_enable_pam_namespace:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/password-auth" id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" check="all" check_existence="all_exist" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" check="all" check_existence="all_exist" comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" check="all" check_existence="all_exist" comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present, with correct deny value, and is followed by pam_unix." version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check control values of pam_unix, that it is followed by pam_faillock.so authfail and deny value of pam_faillock.so authfail" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock.so is called in account phase before pam_unix" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth, has correct deny value, and is followed by pam_unix" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock authfail is present after pam_unix, check pam_unix has proper control values, and authfail deny value is correct." version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check if pam_faillock_so is called in account phase before pam_unix." version="1">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)" version="1">
          <ind:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth" version="1">
          <ind:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" check="all" check_existence="all_exist" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)" version="1">
          <ind:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum authfail fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check maximum preauth fail_interval allowed in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if pam_faillock.so is required in account section in /etc/pam.d/password-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_password-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check if pam_faillock.so is required in account section in /etc/pam.d/system-auth" id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_system-auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if unlock time is never, or greater than or equal external variable" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1" state_operator="OR" version="3">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_greater_or_equal_than_ext_var:ste:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if unlock time is never" id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1" version="3">
          <ind:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" version="1" check="all" comment="Check if external variable unlock time is never">
          <ind:object object_ref="oval:ssg-object_var_faillock_unlock_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_faillock_unlock_time_is_never:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-test_pam_unix_sha512:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:symlink_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
          <unix:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
        </unix:symlink_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd emergency.service to ensure that a   password must be entered to access single user mode" id="oval:ssg-test_require_emergency_service:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the systemd emergency.service is in the emergency.target" id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_emergency_service_emergency:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for emergency.service in /etc/systemd/system" id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_service:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for emergency.target in /etc/systemd/system" id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_emergency_target:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode" id="oval:ssg-test_require_rescue_service:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that the systemd rescue.service is in the runlevel1.target" id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_require_rescue_service_runlevel1:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_rescue_service:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_custom_runlevel1_target:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="only one" check_existence="only_one_exists" comment="check tmux is configured to exec on the last line of /etc/bashrc" id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_bashrc_exec_tmux:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check lock-after-time is set to 900 in /etc/tmux.conf" id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_tmux_lock_after_time:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check lock-command is set to vlock in /etc/tmux.conf" id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_tmux_lock_command:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check_existence="none_exist" check="all" comment="check that tmux is not listed in /etc/shells" id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_no_tmux_in_shells:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_opensc_card_drivers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_opensc_card_drivers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_opensc_nss_db:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_force_opensc_card_drivers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_force_opensc_card_drivers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf" version="1">
          <ind:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
          <ind:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" check="all" check_existence="all_exist" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file" version="1">
          <ind:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user ids in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-obj_count_of_all_uids:obj:1"/>
          <ind:state state_ref="oval:ssg-state_no_duplicate_uids:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" comment="query /etc/passwd">
          <ind:object object_ref="oval:ssg-object_accounts_authorized_local_users:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_authorized_local_users:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd" id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
          <ind:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" check="all" check_existence="all_exist" comment="There should not exist duplicate user name entries in /etc/passwd" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_max_days:tst:1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_days:tst:1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_min_len:tst:1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_pass_warn_age:tst:1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs" version="1">
          <ind:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
          <ind:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
        </ind:variable_test>
        <unix:password_test check="all" comment="password hashes are shadowed" id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
          <unix:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
        </unix:password_test>
        <unix:shadow_test check="all" check_existence="none_exist" comment="password hashes are shadowed using sha512" id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1"/>
        </unix:shadow_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" check="all" check_existence="all_exist" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/password-auth" version="1">
          <ind:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" check="all" check_existence="none_exist" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/password-auth" version="1">
          <ind:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" comment="Check if value of var_password_pam_unix_rounds is the system's default">
          <ind:object object_ref="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" check="all" check_existence="all_exist" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_pam_unix_rounds:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" check="all" check_existence="none_exist" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/system-auth" version="1">
          <ind:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" comment="Check if value of var_password_pam_unix_rounds is the system's default">
          <ind:object object_ref="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1"/>
          <ind:state state_ref="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" check="all" check_existence="all_exist" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" version="1">
          <ind:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure nullok is not used in /etc/pam.d/system-auth" id="oval:ssg-test_no_empty_passwords:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of lines starting with +" id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="look for .netrc in /home" id="oval:ssg-test_no_netrc_files_home:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file" id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/etc/securetty file exists" id="oval:ssg-test_etc_securetty_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="no entries in /etc/securetty" id="oval:ssg-test_no_direct_root_logins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_default_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="SYS_UID_MIN not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="SYS_UID_MAX not defined in /etc/login.defs" check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test state_operator="OR" id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" check="all" check_existence="any_exist" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set" version="1">
          <ind:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
          <ind:state state_ref="oval:ssg-state_uid_less_than_sys_uid_min:ste:1"/>
          <ind:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="serial ports /etc/securetty" id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="virtual consoles /etc/securetty" id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check /etc/pam.d/su for correct setting" id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_use_pam_wheel_for_su:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check value of CREATE_HOME in /etc/login.defs" id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check FAIL_DELAY in /etc/login.defs" id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
          <ind:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf" id="oval:ssg-test_maxlogins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
          <ind:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf" id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test comment="Check that /tmp/tmp-inst exists and has mode 000" check="all" check_existence="only_one_exists" id="oval:ssg-test_tmp_inst:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test comment="Check that /tmp-inst exists and has mode 000" check="all" check_existence="only_one_exists" id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_var_tmp_tmp_inst:obj:1"/>
          <unix:state state_ref="oval:ssg-state_var_tmp_tmp_inst:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file" id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile" id="oval:ssg-test_etc_profile_tmout:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="TMOUT in /etc/profile.d/*.sh" id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="home directories" id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
          <unix:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Check if there aren't directories in root's path having write permission set for group or other" id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
        </unix:file_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with : or ." id="oval:ssg-test_env_var_begins:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row" id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row" id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH ends with : or ." id="oval:ssg-test_env_var_ends:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH starts with an absolute path /" id="oval:ssg-test_env_var_begins_slash:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:environmentvariable58_test check="none satisfy" comment="environment variable PATH contains relative paths" id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
          <ind:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
        </ind:environmentvariable58_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
          <ind:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing" id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_syscall_audit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing" id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_syscall_audit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules configuration locked" id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl configuration locked" id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit selinux changes augenrules" id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit selinux changes auditctl" id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue augenrules" id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net augenrules" id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/hosts augenrules" id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network augenrules" id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue auditctl" id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/issue.net auditctl" id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/hosts auditctl" id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/sysconfig/network auditctl" id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules utmp" id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules btmp" id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules wtmp" id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl utmp" id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl btmp" id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl wtmp" id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl sudoers" id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/group" id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/passwd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/shadow" id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/security/opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0750" id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit mode 0700" id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_directory:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit directories uid root gid root" id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/var/log/audit files uid root gid root" id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0640" id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="/var/log/audit files mode 0600" id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit umount" id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit umount" id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit delete_module" id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit delete_module" id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit delete_module" id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit delete_module" id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit finit_module" id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit finit_module" id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit finit_module" id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit finit_module" id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit init_module" id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit init_module" id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit init_module" id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit init_module" id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit augenrules suid sgid" id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" comment="audit augenrules binaries count matches rules count" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="audit auditctl suid sgid" id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" comment="audit auditctl binaries count matches rules count" version="1">
          <ind:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
          <ind:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit adjtimex" id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit adjtimex" id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit clock_settime" id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit clock_settime" id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit settimeofday" id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit settimeofday" id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit stime" id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit stime" id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch augenrules" id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit /etc/localtime watch auditctl" id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="remote server to send audit records" id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="setting in audisp-remote.conf" id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audispd syslog plugin activated" id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="disk full action" id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_error_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_error_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="disk error action" id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_disk_full_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_disk_full_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="email account for actions" id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf" id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="max log file size" id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="space left action" id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="admin space left action " id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of overflow_action setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_overflow_action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_overflow_action:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_overflow_action:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" comment="Check if /boot/grub2/grub.cfg does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_grub2_admin_username_file_boot_grub2_grub_cfg_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg files. Superuser is not root, admin, or administrator" id="oval:ssg-test_bootloader_unique_superuser:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_unique_superuser:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1" comment="Check if /boot/grub2/grub.cfg does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_grub2_password_file_boot_grub2_grub_cfg_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg files." id="oval:ssg-test_bootloader_superuser:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_bootloader_superuser:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/user.cfg" id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/grub2/grub.cfg" id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_password_grubcfg:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" comment="Check if /boot/grub2/grub.cfg does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg. Superuser is not root, admin, or administrator" id="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1" comment="Check if /boot/grub2/grub.cfg does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in /boot/grub2/grub.cfg." id="oval:ssg-test_bootloader_uefi_superuser:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_bootloader_uefi_superuser:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/efi/EFI/redhat/user.cfg" id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_uefi_password_usercfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in /boot/efi/EFI/redhat/grub.cfg" id="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_uefi_password_grubcfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test HostLimit" id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Test SplitHosts" id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.conf" id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="cron is configured in /etc/rsyslog.d" id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" comment="System log files are owned by the appropriate group">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" comment="System log files are owned by the appropriate user">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" comment="Permissions of system log files are correct">
          <unix:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
          <unix:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method auth monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_auth:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method authpriv monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="remote method daemon monitoring configured in rsyslog'" id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_remote_method_monitoring_daemon:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the presence of daily setting in /etc/logrotate.conf file" id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test if there is no weekly/monthly/yearly keyword" id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)" id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp" id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensures system configured to export logs to remote host" id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls:tst:1" comment="tests the omfwd action configuration" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rsyslog_remote_tls:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" comment="tests the DefaultNetstreamDriverCAFile configuration" check_existence="at_least_one_exists" check="all" version="1">
          <ind:object object_ref="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="check NOZEROCONF=yes in /etc/sysconfig/network" id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_network_nmcli_permissions:tst:1" comment="polkit is properly configured to prevent non-privilged users from changing networking settings" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_network_nmcli_permissions:obj:1"/>
          <ind:state state_ref="oval:ssg-state_network_nmcli_permissions:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:interface_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_promisc_interfaces:tst:1" version="1" comment="check all network interfaces for PROMISC flag">
          <unix:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_promisc:ste:1"/>
        </unix:interface_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Check /etc/firewalld/firewalld.conf DefaultZone for drop" id="oval:ssg-test_firewalld_input_drop:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_firewalld_input_drop:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Define default gateways" id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable privacy extensions on each interface" id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set static IPv6 address on each interface" id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
          <ind:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for udp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Test for tcp6 based rpc services" id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="query /proc/net/wireless" id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_wireless_disable_interfaces:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than 0" id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_uid_zero:obj:1"/>
          <unix:state state_ref="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="all local world-writable directories have sticky bit set" id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
          <unix:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have uid greater than or equal to 1000" id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_uid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_uid_is_user_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="check for local directories that are world writable and have gid greater than or equal to 1000" id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1">
          <unix:object object_ref="oval:ssg-all_local_directories_gid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="system.map files readable only by root" id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
          <unix:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="sgid files outside system RPMs" id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="suid files outside system RPMs" id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="world writable files" id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" comment="files with no group owner" check_existence="none_exist" id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="Check user ids on all files on the system" id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1">
          <unix:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library directories gid root" id="oval:ssg-test_dir_group_ownership_lib_dir:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_dir_group_ownership_lib_dir:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="oval:ssg-test_dir_ownership_lib_dir:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_dir_ownership_lib_dir:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="oval:ssg-dir_test_perms_lib_dir:tst:1" version="1">
          <unix:object object_ref="oval:ssg-dir_object_file_permissions_lib_dir:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="system commands are owned by root" id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_groupownership_system_commands_dirs:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary directories uid root" id="oval:ssg-test_ownership_binary_directories:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary files uid root" id="oval:ssg-test_ownership_binary_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library directories uid root" id="oval:ssg-test_ownership_lib_dir:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_lib_dir:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library files uid root" id="oval:ssg-test_ownership_lib_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_ownership_lib_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="binary files go-w" id="oval:ssg-test_perms_binary_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library directories go-w" id="oval:ssg-test_perms_lib_dir:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_lib_dir:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="library files go-w" id="oval:ssg-test_perms_lib_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_permissions_lib_files:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="none_exist" comment="test if system-wide files have root permissions" id="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1" version="1">
          <unix:object object_ref="oval:ssg-root_permissions_for_system_wide_library_files:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GRUB_CMDLINE_LINUX setting in the /etc/default/grub file" id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_grub2_nousb_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_nousb_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" comment="nodev on local filesystems">
          <linux:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
          <linux:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure /var/tmp is configured to bind mount to /tmp" id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" comment="Ensure /var/tmp is mounted" check="all">
          <linux:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Ensure bind mount option is on /var/tmp" id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" comment="Ensure /var/tmp and /tmp have the same source device" check="all">
          <linux:object object_ref="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1"/>
          <linux:state state_ref="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file" id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_backtraces:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_backtraces:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf file" id="oval:ssg-test_coredump_disable_storage:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_coredump_disable_storage:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coredump_disable_storage:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory" id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d:obj:1"/>
          <ind:state state_ref="oval:ssg-state_core_dumps_limits_d:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory" id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_core_dumps_limits_d_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
          <ind:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
        </ind:variable_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.exec-shield set to 1" id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_kernel_exec_shield:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_kernel_exec_shield:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.exec-shield static configuration" id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NX is disabled" id="oval:ssg-test_nx_disabled_grub:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support for NX bit" id="oval:ssg-test_NX_cpu_support:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_NX_cpu_support:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" id="oval:ssg-test_messages_nx_active:tst:1" version="1" comment="No log messages about NX being disabled">
          <ind:object object_ref="oval:ssg-obj_messages_nx_active:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" comment="NX is not disabled in the kernel command line">
          <ind:object object_ref="oval:ssg-obj_noexec_cmd_line:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" comment="Package kernel-PAE is installed">
          <linux:object object_ref="oval:ssg-obj_package_kernel-PAE_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="CPUs support PAE kernel or NX bit" id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_PAE_NX_cpu_support:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" id="oval:ssg-test_selinux_default_grub:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found" id="oval:ssg-test_selinux_grub_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="device_t in /dev" id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_dev_device_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_device_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="unlabeled_t in /dev" id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_dev_unlabeled_t:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_dev_unlabeled_t:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <linux:selinuxsecuritycontext_test check="none satisfy" check_existence="any_exist" comment="none satisfy unconfined_service_t in /proc" id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2">
          <linux:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
          <linux:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
        </linux:selinuxsecuritycontext_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file" id="oval:ssg-test_selinux_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_etc_selinux_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
          <ind:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" comment="Check for CPU flag lm" check="all" version="1">
          <ind:object object_ref="oval:ssg-object_proc_cpuinfo_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_cpuinfo_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Check if kernel nvr arch is 64-bit" id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" comment="Check if the local dconf DB is up-to-date with keyfiles in the local tree.">
          <ind:object object_ref="oval:ssg-object_local_db_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_local_db_is_up_to_date:ste:1"/>
        </ind:variable_test>
        <unix:file_test id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" check="all" check_existence="none_exist" comment="no keyfiles applicable to the local database" version="1">
          <unix:object object_ref="oval:ssg-obj_dconf_local_config:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="dconf user profile exists" id="oval:ssg-test_dconf_user_profile:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons are disabled" id="oval:ssg-test_disable_restart_buttons:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI restart and shutdown buttons cannot be enabled" id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list is disabled" id="oval:ssg-test_disable_user_list:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI user list cannot be enabled" id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Enable GUI Login Smartcard authentication" id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_enable_gnome_smartcard:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="GUI smartcard authentication cannot be disabled" id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_disable_smartcard:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Set number of login tries" id="oval:ssg-test_configure_allowed_failures:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_allowed_failures:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="number of login attempts cannot be changed" id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Automatic Login" id="oval:ssg-test_disable_automatic_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable GDM Guest Login" id="oval:ssg-test_disable_guest_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Enable setting in the /etc/gdm/custom.conf file" id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1"/>
          <ind:state state_ref="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp" version="1">
          <unix:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount in GNOME3" id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount setting" id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable automount-open in GNOME" id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing automount-open setting" id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable autorun in GNOME" id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from changing autorun setting" id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable thumbnailers in GNOME3" id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_gnome_disable_thumbnailers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot enable thumbnailers " id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi creation" id="oval:ssg-test_disable_wifi_creation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_wifi_creation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi creation capability" id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable wifi notification" id="oval:ssg-test_disable_wifi_notification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_wifi_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of wifi notification capability" id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access credentials" id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access credential requirements" id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="configure remote access encryption" id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="prevent user from disabling remote access encryption" id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="idle delay is configured" id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change idle_activation_enabled" id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change idle_activation_locked" id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay is configured" id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change screensaver idle delay" id="oval:ssg-test_prevent_user_change_idle_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_change_idle_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver idle delay setting is correct" id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is set correctly" id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay cannot be changed by user" id="oval:ssg-test_prevent_user_lock_delay:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_lock_delay:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay setting is correct" id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_delay_setting:obj:1"/>
          <ind:state state_ref="oval:ssg-state_screensaver_lock_delay_setting:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock is enabled" id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver mode is blank" id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="blank screensaver cannot be changed by user" id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver user info is disabled" id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_screensaver_disable_user_info:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver prevent user from changing" id="oval:ssg-test_prevent_user_info_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_info_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="screensaver lock delay cannot be changed by user" id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user cannot change screensaver idle delay" id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable Ctrl-Alt-Del" id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of ctrl-alt-del keys" id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable system geolocation" id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_sys_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of system geolocation" id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_sys_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable clock geolocation" id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_clock_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of clock geolocation" id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_clock_geolocation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Disable power settings" id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_gnome_power_setting:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent enabling of power settings" id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_power_setting_change:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file." check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_bind_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="all" check_existence="all_exist" id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" comment="Check if update-crypto-policies has been run">
          <ind:object object_ref="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1"/>
          <ind:state state_ref="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policies/config" check="all" check_existence="only_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy_current:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current" check="all" check_existence="only_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_configure_crypto_policy_current:obj:1"/>
          <ind:state state_ref="oval:ssg-state_configure_crypto_policy_current:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /etc/crypto-policies/back-ends/nss.config exists" id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_crypto_policy_nss_config:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of '+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0' setting in the /etc/crypto-policies/back-ends/gnutls.config file" id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" check="all" check_existence="all_exist" comment="Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file" version="1">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" check="all" check_existence="all_exist" comment="Check if kerberos configuration symlink links to the crypto-policy backend file" version="1">
          <ind:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
          <ind:state state_ref="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1"/>
        </ind:variable_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_libreswan_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies." check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_openssl_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies." check="all" check_existence="none_exist" version="1">
          <ind:object object_ref="oval:ssg-object_configure_ssh_crypto_policy:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of Match setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of RekeyLimit setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of Ciphers setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of PubkeyAcceptedKeyTypes setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of MACs setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the absence of KexAlgorithms setting in the /etc/ssh/ssh_config.d/02-ospp.conf file" id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/openssh.config file" id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of CRYPTO_POLICY setting in the /etc/crypto-policies/back-ends/opensshserver.config file" id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-state_harden_sshd_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/openssh.config file" id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="/selinux/enforce is 1" id="oval:ssg-test_selinux_enforcing:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_selinux_enforcing:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" comment="AntiVirus package is installed">
          <linux:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" comment="Runtime Libraries package is installed">
          <linux:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" comment="Agent package is installed">
          <linux:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="McAfee ACCM installed" id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="McAfee Policy Auditor installed" id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="add_dracutmodules contains fips" id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_enable_dracut_fips_module:obj:1"/>
          <ind:state state_ref="oval:ssg-state_enable_dracut_fips_module:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test check="at least one" comment="tests if var_system_crypto_policy is set to FIPS" id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_system_crypto_policy_value:obj:1"/>
          <ind:state state_ref="oval:ssg-ste_system_crypto_policy_value:ste:1"/>
        </ind:variable_test>
        <unix:file_test version="1" id="oval:ssg-test_etc_system_fips:tst:1" check="all" check_existence="all_exist" comment="/etc/system-fips exists">
          <unix:object object_ref="oval:ssg-object_etc_system_fips:obj:1"/>
        </unix:file_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter crypto.fips_enabled set to 1" id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1"/>
        </unix:sysctl_test>
        <unix:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of new aide database file" version="1">
          <unix:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
        </unix:file_test>
        <unix:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" check="all" check_existence="all_exist" comment="Testing existence of operational aide database file" version="1">
          <unix:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditctl:tst:1" comment="auditctl is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditctl:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_auditd:tst:1" comment="auditd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_auditd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_ausearch:tst:1" comment="ausearch is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_ausearch:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_aureport:tst:1" comment="aureport is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_aureport:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_autrace:tst:1" comment="autrace is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_autrace:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_audispd:tst:1" comment="audispd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_audispd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_rsyslogd:tst:1" comment="rsyslogd is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_rsyslogd:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_aide_verify_augenrules:tst:1" comment="augenrules is checked in /etc/aide.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_aide_verify_augenrules:obj:1"/>
          <ind:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_crond_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron" id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="run aide with cron.(daily|weekly)" id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2">
          <ind:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check="all" comment="verify file md5 hashes">
          <linux:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
        </linux:rpmverifyfile_test>
        <linux:rpmverifyfile_test check_existence="none_exist" id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check="all" comment="mode of all files matches local rpm database">
          <linux:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
        </linux:rpmverifyfile_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers" id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="!authenticate does not exist in /etc/sudoers.d" id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist /etc/sudoers" id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD does not exist in /etc/sudoers.d" id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD only exists for vdsm user in /etc/sudoers" id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d" id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no command in user spec is without any argument" id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_explicit_command_args:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no command in user spec contains negation" id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_sudoers_no_command_negation:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL" id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1">
          <ind:object object_ref="oval:ssg-root_or_ALL_in_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="make sure that all user specs in sudoers feature a runas spec" id="oval:ssg-test_no_user_spec_rules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_no_runas_spec:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure invoking user's password for privilege escalation when using sudo" id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of apply_updates setting in the /etc/dnf/automatic.conf file" id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_apply_updates:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates" version="1">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file" id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dnf-automatic_security_updates_only:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" check="all" check_existence="all_exist" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only" version="1">
          <unix:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" comment="Fedora 9867c58f release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" comment="Fedora 45719a39 release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="only one" check_existence="at_least_one_exists" id="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1" version="1" comment="Fedora 9570ff31 release key package is installed">
          <linux:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
          <linux:state state_ref="oval:ssg-state_package_gpg-pubkey-9570ff31-5e3006fb:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf" id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files" id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_dictcheck:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_difok:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/pwquality.conf file" id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'enforce_for_root' setting in the /etc/security/pwquality.conf file" id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_lcredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxclassrepeat:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_maxrepeat:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minclass:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ocredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/security/pwquality.conf" id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
          <ind:state state_ref="oval:ssg-state_password_pam_ucredit:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/faillock.conf file" id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_passwords_pam_faillock_enforce_local:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chmod" id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chmod" id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit chown" id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit chown" id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmod" id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmod" id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchmodat" id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchmodat" id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchown" id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchown" id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fchownat" id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fchownat" id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fremovexattr" id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fremovexattr" id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit fsetxattr" id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit fsetxattr" id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lchown" id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lchown" id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lremovexattr" id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lremovexattr" id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit lsetxattr" id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit lsetxattr" id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit removexattr" id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit removexattr" id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit setxattr" id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit setxattr" id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit umount2" id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit umount2" id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit umount2" id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit umount2" id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chcon" id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chcon" id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules restorecon" id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl restorecon" id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules semanage" id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl semanage" id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules setsebool" id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl setsebool" id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules seunshare" id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl seunshare" id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit rename" id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit rename" id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit rename" id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit rename" id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit renameat" id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit renameat" id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit renameat" id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit renameat" id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit rmdir" id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit rmdir" id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit rmdir" id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit rmdir" id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit unlink" id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit unlink" id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit unlink" id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit unlink" id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit unlinkat" id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit unlinkat" id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit unlinkat" id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit unlinkat" id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules faillock" id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_faillock_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl faillock" id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_faillock_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules lastlog" id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl lastlog" id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules tallylog" id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl tallylog" id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit mount" id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit mount" id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit mount" id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit mount" id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules at" id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl at" id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chage" id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chage" id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules chsh" id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl chsh" id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules crontab" id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl crontab" id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules gpasswd" id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl gpasswd" id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules mount" id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl mount" id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newgidmap" id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newgidmap" id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newgrp" id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newgrp" id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules newuidmap" id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl newuidmap" id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules passwd" id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl passwd" id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules pt_chown" id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl pt_chown" id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules ssh_keysign" id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl ssh_keysign" id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules su" id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl su" id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules sudo" id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl sudo" id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules sudoedit" id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl sudoedit" id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules umount" id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl umount" id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules unix_chkpwd" id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl unix_chkpwd" id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules userhelper" id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl userhelper" id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit augenrules usernetctl" id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit auditctl usernetctl" id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="Test order of audit 32bit auditctl eperm rules order" id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="defined audit rule must exist" id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eacces" id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit file eperm" id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eacces" id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit file eperm" id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules group" id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit group" id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit gshadow" id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit opasswd" id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules passwd" id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit passwd" id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules shadow" id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit shadow" id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of freq setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_freq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_freq:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_freq:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of local_events setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_local_events:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_local_events:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_local_events:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of local_events setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of log_format setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_log_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_log_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_log_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of name_format setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_name_format:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_name_format:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_name_format:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of write_logs setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_write_logs:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs:obj:1"/>
          <ind:state state_ref="oval:ssg-state_auditd_write_logs:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of write_logs setting in the /etc/audit/auditd.conf file" id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="none_exist" id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" comment="Check if /boot/loader/entries/ostree-2-.*.conf does not exist" version="1">
          <unix:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-1-.*.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-2-.*.conf" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" comment="Check if argument selinux=0 is present in the line starting with 'BOOT_IMAGE' in /proc/cmdline" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1"/>
          <ind:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of user-administration-disabled setting in the /etc/dconf/db/local.d/ file" id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from modifying user-administration-disabled" id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of removal-action setting in the /etc/dconf/db/local.d/ file" id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1"/>
          <ind:state state_ref="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Prevent user from modifying removal-action" id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_prevent_user_removal-action:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_disable_host_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of HostbasedAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_disable_host_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of HostbasedAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_disable_host_auth_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing group ownership of /etc/group-" id="oval:ssg-test_file_groupowner_backup_etc_group:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_backup_etc_group_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing group ownership of /etc/gshadow-" id="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing group ownership of /etc/passwd-" id="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing group ownership of /etc/shadow-" id="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_backup_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_efi_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/group" id="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_group_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/gshadow" id="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_gshadow_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/issue" id="oval:ssg-test_file_groupowner_etc_issue:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_issue:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_issue_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing group ownership of /etc/motd" id="oval:ssg-test_file_groupowner_etc_motd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_motd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_motd_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_passwd_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/shadow" id="oval:ssg-test_file_groupowner_etc_shadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_etc_shadow_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_groupowner_grub2_cfg:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_grub2_cfg_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /var/log/" id="oval:ssg-test_file_groupowner_var_log:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_var_log_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /var/log/messages" id="oval:ssg-test_file_groupowner_var_log_messages:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_groupowner_var_log_messages:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_groupowner_var_log_messages_gid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing user ownership of /etc/group-" id="oval:ssg-test_file_owner_backup_etc_group:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_backup_etc_group_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing user ownership of /etc/gshadow-" id="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing user ownership of /etc/passwd-" id="oval:ssg-test_file_owner_backup_etc_passwd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_backup_etc_passwd_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing user ownership of /etc/shadow-" id="oval:ssg-test_file_owner_backup_etc_shadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_backup_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_backup_etc_shadow_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_efi_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/group" id="oval:ssg-test_file_owner_etc_group:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_group_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/gshadow" id="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_gshadow_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/issue" id="oval:ssg-test_file_owner_etc_issue:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_issue:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_issue_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="any_exist" comment="Testing user ownership of /etc/motd" id="oval:ssg-test_file_owner_etc_motd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_motd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_motd_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/passwd" id="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_passwd_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /etc/shadow" id="oval:ssg-test_file_owner_etc_shadow:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_etc_shadow_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /boot/grub2/grub.cfg" id="oval:ssg-test_file_owner_grub2_cfg:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_grub2_cfg_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /var/log/" id="oval:ssg-test_file_owner_var_log:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_var_log_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership of /var/log/messages" id="oval:ssg-test_file_owner_var_log_messages:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_owner_var_log_messages:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_owner_var_log_messages_uid_0:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/group-" id="oval:ssg-test_file_permissions_backup_etc_group:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/gshadow-" id="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/passwd-" id="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/shadow-" id="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_backup_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/audit/auditd.conf" id="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_auditd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/audit/rules.d/" id="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_audit_rulesd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/group" id="oval:ssg-test_file_permissions_etc_group:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_group:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/gshadow" id="oval:ssg-test_file_permissions_etc_gshadow:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_gshadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/issue" id="oval:ssg-test_file_permissions_etc_issue:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_issue:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/motd" id="oval:ssg-test_file_permissions_etc_motd:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_motd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/passwd" id="oval:ssg-test_file_permissions_etc_passwd:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_passwd:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/shadow" id="oval:ssg-test_file_permissions_etc_shadow:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_etc_shadow:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /boot/grub2/grub.cfg" id="oval:ssg-test_file_permissions_grub2_cfg:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_grub2_cfg:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/ssh/" id="oval:ssg-test_file_permissions_sshd_private_key:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_private_key:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /etc/ssh/" id="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /var/log/" id="oval:ssg-test_file_permissions_var_log:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Testing mode of /var/log/messages" id="oval:ssg-test_file_permissions_var_log_messages:tst:1" version="2">
          <unix:object object_ref="oval:ssg-object_file_permissions_var_log_messages:obj:1"/>
          <unix:state state_ref="oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" comment="check forkernel command line parameters audit=1 in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" comment="check forkernel command line parameters audit_backlog_limit=8192 in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" comment="check forkernel command line parameters iommu=force in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_iommu_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" comment="check forkernel command line parameters ipv6.disable=1 in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" comment="check forkernel command line parameters page_poison=1 in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_page_poison_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" comment="check forkernel command line parameters pti=on in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_pti_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" comment="check forkernel command line parameters slub_debug=P in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_slub_debug_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" comment="check forkernel command line parameters vsyscall=none in /boot/grub2/grubenv for all kernels" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_vsyscall_argument_grub_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" comment="package openssl-pkcs11 is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" comment="kernel module atm disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" comment="kernel module can disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_can_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" comment="kernel module firewire-core disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" comment="kernel module vfat disabled">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modprobe.conf">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
          <ind:object object_ref="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="1" comment="noauto on /boot optional yes">
          <linux:object object_ref="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="1" comment="nodev on /boot optional yes">
          <linux:object object_ref="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /boot optional yes">
          <linux:object object_ref="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /boot optional yes">
          <linux:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="1" comment="nodev on /dev/shm optional no">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" comment="/dev/shm exists">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="1" comment="noexec on /dev/shm optional no">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" comment="/dev/shm exists">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="1" comment="nosuid on /dev/shm optional no">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
          <linux:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" comment="/dev/shm exists">
          <linux:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /home optional yes">
          <linux:object object_ref="oval:ssg-object_home_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_home_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" check_existence="any_exist" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" check="at least one" check_existence="all_exist" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /opt optional yes">
          <linux:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /srv optional yes">
          <linux:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="1" comment="nodev on /tmp optional yes">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /tmp optional yes">
          <linux:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /tmp optional yes">
          <linux:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="1" comment="nodev on /var/log/audit optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /var/log/audit optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /var/log/audit optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="1" comment="nodev on /var/log optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /var/log optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /var/log optional yes">
          <linux:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="1" comment="nodev on /var optional yes">
          <linux:object object_ref="oval:ssg-object_var_partition_nodev_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nodev_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="1" comment="noexec on /var optional yes">
          <linux:object object_ref="oval:ssg-object_var_partition_noexec_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_noexec_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="1" comment="nosuid on /var optional yes">
          <linux:object object_ref="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1"/>
          <linux:state state_ref="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1"/>
        </linux:partition_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" comment="package GConf2 is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_GConf2_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" comment="package MFEhiplsm is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" comment="package abrt-addon-ccpp is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" comment="package abrt-addon-kerneloops is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-addon-python_removed:tst:1" version="1" comment="package abrt-addon-python is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" comment="package abrt-cli is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-cli_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" comment="package abrt-plugin-logger is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" comment="package abrt-plugin-rhtsupport is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" comment="package abrt-plugin-sosreport is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_abrt_removed:tst:1" version="1" comment="package abrt is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_abrt_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_aide_installed:tst:1" version="1" comment="package aide is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_aide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" comment="package audispd-plugins is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" comment="package audit-audispd-plugins is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_audit_installed:tst:1" version="1" comment="package audit is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_avahi_installed:tst:1" version="1" comment="package avahi is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_avahi_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_bind_removed:tst:1" version="1" comment="package bind is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_bind_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_binutils_installed:tst:1" version="1" comment="package binutils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_binutils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cron_installed:tst:1" version="1" comment="package cron is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_cron_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" comment="package cryptsetup-luks is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dconf_installed:tst:1" version="1" comment="package dconf is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_dconf_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" comment="package dnf-automatic is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_esc_installed:tst:1" version="1" comment="package esc is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_esc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" comment="package fapolicyd is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_fapolicyd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gdm_installed:tst:1" version="1" comment="package gdm is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_gdm_removed:tst:1" version="1" comment="package gdm is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_gdm_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" comment="package geolite2-city is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_geolite2-city_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" comment="package geolite2-country is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_geolite2-country_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" comment="package gnutls-utils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" comment="package gssproxy is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_gssproxy_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" comment="package inetutils-telnetd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" comment="package iprutils is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_iprutils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_iptables_installed:tst:1" version="1" comment="package iptables is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" comment="package krb5-workstation is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" comment="package libcap-ng-utils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" comment="package libreswan is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libreswan_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" comment="package libselinux is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_libselinux_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" comment="package mcstrans is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_mcstrans_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" comment="package net-snmp is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_net-snmp_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_nis_removed:tst:1" version="1" comment="package nis is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_nis_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" comment="package nss-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_nss-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" comment="package ntpdate is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_ntpdate_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" comment="package openldap-clients is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_openldap-clients_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_opensc_installed:tst:1" version="1" comment="package opensc is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_opensc_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" comment="package openscap-scanner is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" comment="package openssh-server is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" comment="package pam_ldap is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_pam_ldap_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" comment="package policycoreutils is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_policycoreutils_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_prelink_removed:tst:1" version="1" comment="package prelink is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_prelink_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rear_installed:tst:1" version="1" comment="package rear is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rear_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" comment="package rng-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" comment="package rsyslog-gnutls is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" comment="package samba-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_samba-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" comment="package scap-security-guide is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_screen_installed:tst:1" version="1" comment="package screen is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_screen_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" comment="package sendmail is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_sendmail_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" comment="package setroubleshoot-plugins is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" comment="package setroubleshoot-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" comment="package setroubleshoot is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" comment="package sssd-ipa is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_sudo_installed:tst:1" version="1" comment="package sudo is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_syslogng_installed:tst:1" version="1" comment="package syslogng is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_syslogng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_tar_installed:tst:1" version="1" comment="package tar is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_tar_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" comment="package telnetd-ssl is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" comment="package telnetd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_telnetd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_tmux_installed:tst:1" version="1" comment="package tmux is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_tmux_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_tuned_removed:tst:1" version="1" comment="package tuned is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_tuned_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" comment="package usbguard is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" comment="package vim-enhanced is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" comment="package vsftpd is installed">
          <linux:object object_ref="oval:ssg-obj_test_package_vsftpd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" comment="package vsftpd is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_vsftpd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" comment="package xorg-x11-server-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testboot_partition:tst:1" version="1" comment="/boot on own partition">
          <linux:object object_ref="oval:ssg-object_mountboot_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testhome_partition:tst:1" version="1" comment="/home on own partition">
          <linux:object object_ref="oval:ssg-object_mounthome_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testopt_partition:tst:1" version="1" comment="/opt on own partition">
          <linux:object object_ref="oval:ssg-object_mountopt_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testsrv_partition:tst:1" version="1" comment="/srv on own partition">
          <linux:object object_ref="oval:ssg-object_mountsrv_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testtmp_partition:tst:1" version="1" comment="/tmp on own partition">
          <linux:object object_ref="oval:ssg-object_mounttmp_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testusr_partition:tst:1" version="1" comment="/usr on own partition">
          <linux:object object_ref="oval:ssg-object_mountusr_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_partition:tst:1" version="1" comment="/var on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_log_partition:tst:1" version="1" comment="/var/log on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_log_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:partition_test check="all" check_existence="all_exist" id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" comment="/var/log/audit on own partition">
          <linux:object object_ref="oval:ssg-object_mountvar_log_audit_own_partition:obj:1"/>
        </linux:partition_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_atd:tst:1" check="all" check_existence="any_exist" comment="Test that the atd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service atd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_atd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" comment="package at is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_atd_package_at_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_auditd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_auditd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the auditd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_auditd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_auditd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" comment="package audit is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_autofs:tst:1" check="all" check_existence="any_exist" comment="Test that the autofs service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service autofs is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" comment="package autofs is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_bluetooth:tst:1" check="all" check_existence="any_exist" comment="Test that the bluetooth service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_bluetooth:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_bluetooth:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service bluetooth is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" comment="package bluez is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_chronyd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_chronyd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the chronyd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_chronyd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_chronyd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_cron_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_cron:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the cron service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_cron:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_cron:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" comment="package cron is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_crond_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_crond:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the crond service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_crond:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_crond:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" comment="package cronie is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_debug-shell:tst:1" check="all" check_existence="any_exist" comment="Test that the debug-shell service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service debug-shell is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" comment="package systemd is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_firewalld_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_firewalld:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the firewalld service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_firewalld:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_firewalld:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" comment="package firewalld is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ip6tables_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ip6tables_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ip6tables:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ip6tables service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ip6tables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ip6tables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" comment="package iptables-ipv6 is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_iptables_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_iptables:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the iptables service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_iptables:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_iptables:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" comment="package iptables is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_netfs:tst:1" check="all" check_existence="any_exist" comment="Test that the netfs service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_netfs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_netfs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service netfs is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" comment="package netfs is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfs-server:tst:1" check="all" check_existence="any_exist" comment="Test that the nfs-server service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_nfs-server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_nfs-server:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service nfs-server is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfslock:tst:1" check="all" check_existence="any_exist" comment="Test that the nfslock service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_nfslock:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_nfslock:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service nfslock is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntp_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntp_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ntp:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ntp service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ntp:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ntp:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_ntpd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_ntpd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the ntpd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_ntpd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_ntpd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_pcscd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_pcscd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the pcscd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_pcscd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_pcscd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" comment="package pcsc-lite is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rngd_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rngd:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the rngd service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_rngd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rngd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" comment="package rng-tools is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcgssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcgssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcidmapd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcidmapd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcidmapd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcidmapd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the rpcsvcgssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rpcsvcgssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" comment="package nfs-utils is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_rsyncd:tst:1" check="all" check_existence="any_exist" comment="Test that the rsyncd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service rsyncd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" comment="package rsync-daemon is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_rsyslog_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_rsyslog:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the rsyslog service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_rsyslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_rsyslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" comment="package rsyslog is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_sshd:tst:1" check="all" check_existence="any_exist" comment="Test that the sshd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service sshd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" comment="package openssh-server is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_sssd:tst:1" check="all" check_existence="any_exist" comment="Test that the sssd service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_sssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_sssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service sssd is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" comment="package sssd-common is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_syslog:tst:1" check="all" check_existence="any_exist" comment="Test that the syslog service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_syslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_syslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service syslog is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" comment="package rsyslog is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_syslogng:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslogng_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslogng_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_syslogng_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_syslogng_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_syslogng:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the syslogng service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_syslogng:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_syslogng:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" version="1" comment="package syslogng is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_syslogng_package_syslogng_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" check="all" check_existence="any_exist" comment="Test that the systemd-coredump service is not running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_not_running_systemd-coredump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_not_running_systemd-coredump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" check="all" check_existence="any_exist" comment="Test that the property LoadState from the service systemd-coredump is masked" version="1">
          <linux:object object_ref="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="none_exist" id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" comment="package systemd is removed">
          <linux:object object_ref="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1"/>
        </linux:rpminfo_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_usbguard_socket_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_service_running_usbguard:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the usbguard service is running" version="1">
          <linux:object object_ref="oval:ssg-obj_service_running_usbguard:obj:1"/>
          <linux:state state_ref="oval:ssg-state_service_running_usbguard:ste:1"/>
        </linux:systemdunitproperty_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" comment="package usbguard is installed">
          <linux:object object_ref="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of KerberosAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of KerberosAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of IgnoreRhosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of IgnoreRhosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitRootLogin setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitUserEnvironment setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PermitUserEnvironment setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of StrictModes setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of StrictModes setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of 'Include /etc/ssh/sshd_config.d/*.conf' setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_includes_config_files:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_print_last_log:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PrintLastLog setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_print_last_log_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of PrintLastLog setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of X11UseLocalhost setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config.d file" id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="tests the absence of X11UseLocalhost setting in the /etc/ssh/sshd_config file" id="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir_default_not_overriden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="tests the presence of '^\[certmap\/.+\/.+\]$' setting in the /etc/sssd/sssd.conf file" id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sssd_enable_certmap:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_noexec_sudoers:tst:1" comment="noexec exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_noexec_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_requiretty_sudoers:tst:1" comment="requiretty exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_requiretty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_use_pty_sudoers:tst:1" comment="use_pty exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_use_pty_sudoers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_logfile_sudoers:tst:1" comment="logfile exists in /etc/sudoers or /etc/sudoers.d/" version="1">
          <ind:object object_ref="oval:ssg-object_logfile_sudoers:obj:1"/>
          <ind:state state_ref="oval:ssg-state_logfile_sudoers:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_hardlinks set to 1" id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_hardlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.protected_symlinks set to 1" id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.protected_symlinks static configuration" id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter fs.suid_dumpable set to 0" id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="fs.suid_dumpable static configuration" id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false" id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.core_pattern static configuration" id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.dmesg_restrict set to 1" id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.dmesg_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1" id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.kexec_load_disabled static configuration" id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.kptr_restrict set to 1" id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.kptr_restrict static configuration" id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.modules_disabled set to 1" id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.modules_disabled static configuration" id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_cpu_time_max_percent static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_max_sample_rate static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.perf_event_paranoid static configuration" id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.pid_max set to 65536" id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.pid_max static configuration" id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.randomize_va_space set to 2" id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.randomize_va_space static configuration" id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.sysrq set to 0" id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.sysrq static configuration" id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1" id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.unprivileged_bpf_disabled static configuration" id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1" id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="kernel.yama.ptrace_scope static configuration" id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2" id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.core.bpf_jit_harden static configuration" id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.log_martians static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.rp_filter static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.secure_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.all.send_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.accept_source_route static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.log_martians static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.rp_filter static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.secure_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0" id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.conf.default.send_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_forward set to 0" id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_forward static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535" id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.ip_local_port_range static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv4.tcp_syncookies static configuration" id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.autoconf static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.disable_ipv6 static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.max_addresses static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.all.router_solicitations static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.accept_redirects static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.autoconf static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.disable_ipv6 static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.max_addresses static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value" id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="net.ipv6.conf.default.router_solicitations static configuration" id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
          <ind:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter user.max_user_namespaces set to 0" id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="user.max_user_namespaces static configuration" id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:sysctl_test check="all" check_existence="all_exist" comment="kernel runtime parameter vm.mmap_min_addr set to 65536" id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1"/>
          <unix:state state_ref="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1"/>
        </unix:sysctl_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="vm.mmap_min_addr static configuration" id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf" id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:systemdunitdependency_test check="all" check_existence="any_exist" comment="systemd test" id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1"/>
          <linux:state state_ref="oval:ssg-state_systemd_dnf-automatic_on:ste:1"/>
        </linux:systemdunitdependency_test>
        <linux:systemdunitproperty_test id="oval:ssg-test_timer_running_dnf-automatic:tst:1" check="at least one" check_existence="at_least_one_exists" comment="Test that the dnf-automatic timer is running" version="1">
          <linux:object object_ref="oval:ssg-obj_timer_running_dnf-automatic:obj:1"/>
          <linux:state state_ref="oval:ssg-state_timer_running_dnf-automatic:ste:1"/>
        </linux:systemdunitproperty_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_accounts_password_pam_faillock:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="check the configuration of /etc/pam.d/system-auth" id="oval:ssg-test_password_pam_pwquality:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl" id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules" id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_audit_rules_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit setdomainname" id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit setdomainname" id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit setdomainname" id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit setdomainname" id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 32-bit sethostname" id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit augenrules 64-bit sethostname" id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 32-bit sethostname" id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="audit auditctl 64-bit sethostname" id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" check="all" check_existence="none_exist" comment="log_group = root" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" check="all" check_existence="all_exist" comment="log_group is set" version="1">
          <ind:object object_ref="oval:ssg-object_auditd_conf_log_group_is_set:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
          <ind:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test id="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub" check="all" check_existence="all_exist" version="1">
          <ind:object object_ref="oval:ssg-object_grub2_default_exists:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos8_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_10:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_9:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="fedora-release RPM packages are installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 7" id="oval:ssg-test_ol7_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 8" id="oval:ssg-test_ol8_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE is installed" id="oval:ssg-test_opensuse_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 15 is installed" id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 42 is installed" id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" comment="os-release is rhcos" id="oval:ssg-test_rhcos:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="rhcoreos is version 4" id="oval:ssg-test_rhcos4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-client is version 7" id="oval:ssg-test_rhel7_client:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 7" id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel8_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8" id="oval:ssg-test_rhel8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.0" id="oval:ssg-test_rhel8_0:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.1" id="oval:ssg-test_rhel8_1:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.2" id="oval:ssg-test_rhel8_2:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.3" id="oval:ssg-test_rhel8_3:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.4" id="oval:ssg-test_rhel8_4:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.5" id="oval:ssg-test_rhel8_5:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.6" id="oval:ssg-test_rhel8_6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.7" id="oval:ssg-test_rhel8_7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.8" id="oval:ssg-test_rhel8_8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.9" id="oval:ssg-test_rhel8_9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.10" id="oval:ssg-test_rhel8_10:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel9_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 9" id="oval:ssg-test_rhel9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel9:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 9" id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="redhat-release-virtualization-host RPM package is installed" id="oval:ssg-test_rhvh4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle12_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 6" id="oval:ssg-test_sle12_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 6" id="oval:ssg-test_sle12_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 12" id="oval:ssg-test_sles_12_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle15_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 15" id="oval:ssg-test_sle15_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 15" id="oval:ssg-test_sle15_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 15" id="oval:ssg-test_sles_15_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/lsb-release exists" id="oval:ssg-test_lsb:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_lsb:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu" id="oval:ssg-test_ubuntu:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_xenial:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_bionic:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_focal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux8:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux8 version" id="oval:ssg-test_wrlinux8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenStack is version 10" id="oval:ssg-test_rhosp10_release:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhosp10_release:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhosp10_release:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenStack is version 13" id="oval:ssg-test_rhosp13_release:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhosp13_release:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhosp13_release:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="rhevm4-appliance is installed" id="oval:ssg-test_rhevm4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" comment="system has package audit installed">
          <linux:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" comment="system has package gdm installed">
          <linux:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" comment="system has package grub2-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /sys/firmware/opal exists" id="oval:ssg-test_system_using_opal:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" comment="system has package libuser installed">
          <linux:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
          <linux:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" comment="system has package net-snmp installed">
          <linux:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" comment="system has package nss-pam-ldapd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" comment="system has package pam installed">
          <linux:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" comment="package postfix is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" comment="system has package sssd-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" comment="system has package sudo installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" comment="system has package systemd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" comment="system has package yum installed">
          <linux:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" comment="system has package zipl installed">
          <linux:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /.dockerenv exists" id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /run/.containerenv exists" id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" check_existence="none_exist" check="all" comment="'CD/DVD drive is not listed in /etc/fstab" version="1">
          <ind:object object_ref="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for s390x architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" check="all" check_existence="none_exist" comment="Check if expected removable partitions truly exist on the system" version="1">
          <unix:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
        </unix:file_test>
        <ind:variable_test id="oval:ssg-test_sshd_not_required:tst:1" comment="Verify if Profile set Value sshd_required as not required" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_not_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_not_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_required:tst:1" comment="Verify if Profile set Value sshd_required as required" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_required:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_required:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_sshd_requirement_unset:tst:1" comment="Verify if Value of sshd_required is the default" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_sshd_requirement_unknown:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sshd_requirement_unset:ste:1"/>
        </ind:variable_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenSSH is version 7.4 or higher" id="oval:ssg-test_openssh-server_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_openssh-server_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_openssh-server_version:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Testing if /etc/sssd/sssd.conf exists" id="oval:ssg-test_sssd_conf_exists:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_sssd_conf_exists:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SSSD Configuration is set to use Active Directory" id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Verify if /sys/firmware/efi folder exists" id="oval:ssg-test_efi_dir_existence:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
        </unix:file_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_aarch_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_aarch_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_s390_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_s390_64:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="32 bit architecture" id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
        </unix:uname_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
        </unix:uname_test>
        <ind:textfilecontent54_test check_existence="at_least_one_exists" check="all" comment="Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists" id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_usbguard_rules_nonempty:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" comment="Verify the existence of var_accounts_user_umask_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" check="all" comment="Check if removable partition variable value represents CD/DVD drive" version="1">
          <ind:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
          <ind:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
        </ind:variable_test>
        <ind:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" comment="Verify the existence of var_umask_for_daemons_as_number variable" check="all" check_existence="at_least_one_exists" version="1">
          <ind:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
        </ind:variable_test>
      </oval-def:tests>
      <oval-def:objects>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="log ftp transactions" id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Banner for FTP Users" id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1">
          <ind:filepath>/etc/vsftpd/vsftpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*banner_file=/etc/issue[\s]*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_kerberos_disable_no_keytab:obj:1" version="1" comment="Default Kerberos keytab file">
          <unix:filepath operation="pattern match">^/etc/.+\.keytab$</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_root_mail_alias:obj:1" version="1">
          <ind:filepath operation="equals">/etc/aliases</ind:filepath>
          <ind:pattern operation="pattern match">^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
          <ind:filepath>/etc/exports</ind:filepath>
          <ind:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*port[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1">
          <ind:filepath>/etc/chrony.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*cmdport[\s]+(\S+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_set_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_set_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/chronyd</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*OPTIONS=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1" comment="The configuration file /etc/sysconfig/chronyd for chronyd_run_as_chrony_user" version="1">
          <unix:filepath operation="pattern match">^/etc/sysconfig/chronyd</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object comment="Ensure at least one NTP server is set" id="oval:ssg-object_chronyd_remote_server:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?:server|pool)[\s]+.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="ensure ipv4 restrictions" id="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*restrict[\s]+(-4[\s]*)?default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="ensure ipv6 restrictions" id="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*restrict[\s]+-6[\s]+default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1" version="1" comment="check /etc/sysconfig/ntpd">
          <ind:filepath>/etc/sysconfig/ntpd</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*OPTIONS=.*-u ntp:ntp.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1" version="1" comment="check /usr/lib/systemd/system/ntpd.service">
          <ind:filepath>/usr/lib/systemd/system/ntpd.service</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*ExecStart=.*-u ntp:ntp.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure more than one ntpd NTP server is set" id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure at least one ntpd NTP server is set" id="oval:ssg-obj_ntp_remote_server:obj:1" version="1">
          <ind:filepath>/etc/ntp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for .rhosts in /root" id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1">
          <unix:path operation="equals">/root</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for .rhosts in /home" id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.rhosts$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for /etc/hosts.equiv" id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1">
          <unix:path operation="equals">/etc</unix:path>
          <unix:filename operation="pattern match">^hosts\.equiv$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
          <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^((?!#).)*(public|private).*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
          <ind:filepath>/etc/snmp/snmpd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern var_ref="oval:ssg-sshd_line_regex:var:1" operation="pattern match"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_auth_tries:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sshd_max_sessions:obj:1" version="2">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1" version="1">
          <ind:filepath operation="equals">/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)match(?-i)\s+\S+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_certificate_verification:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[sssd](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*ocsp_dgst\s*=\s*(\w+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_memcache_timeout:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[nss](?:[^\n\[]*\n+)+?[\s]*memcache_timeout[\s]*=[\s]*(\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_user_value:obj:1" comment="get last user value from each [sssd] section" version="1">
          <ind:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*user[ \t]*=[ \t]*(\S*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[ssh](?:[^\n\[]*\n+)+?[\s]*ssh_known_hosts_timeout[\s]*=[\s]*(\d+)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_usbguard_auditbackend:obj:1" version="1">
          <ind:filepath>/etc/usbguard/usbguard-daemon.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1" comment="The configuration file /etc/usbguard/usbguard-daemon.conf for configure_usbguard_auditbackend" version="1">
          <unix:filepath operation="pattern match">^/etc/usbguard/usbguard-daemon.conf</unix:filepath>
        </unix:file_object>
        <unix:symlink_object comment="default.target systemd softlink exists" id="oval:ssg-object_disable_xwindows_runlevel_target:obj:1" version="1">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath operation="pattern match">^/etc/issue(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_banner_etc_motd:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/motd</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?banner-message-enable=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^banner-message-text=[\s]*'*(.*?)'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
          <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog.so[\s\w\d\=]+showfailed(\s|$)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_display_login_attempts_silent:obj:1" version="1">
          <ind:filepath>/etc/pam.d/postlogin</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog.so[\s\w\d\=]+silent(\s|$)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_enable_pam_namespace:obj:1" version="1">
          <ind:filepath>/etc/pam.d/login</ind:filepath>
          <ind:pattern operation="pattern match">^\s*session\s+required\s+pam_namespace\.so\s*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-pwhistory_line_regex_password_auth:var:1" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern var_ref="oval:ssg-pwhistory_line_regex_system_auth:var:1" operation="pattern match"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_system-auth:obj:1" comment="Get number of lines pam_unix defaults to" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+\[.*default=([0-9]+).*\][\s]+pam_unix\.so</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1" comment="Is pam_faillock not skipped?" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_system-auth:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_password-auth:obj:1" comment="Get number of lines pam_unix defaults to" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+\[[^\]]*default=([0-9]+)[^\]]*\][\s]+pam_unix\.so</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1" comment="Is pam_faillock not skipped?" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_password-auth:var:1"/>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[[^\]]*default=ignore[^\]]*\]))[^\n]+pam_unix\.so(?:.*[\n])*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[^\n]+deny=([0-9]+)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[[^\]]*default=ignore[[^\]]*\]))[\s]+pam_unix\.so(?:.*[\n])*[^\n]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_password-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*account\s+required\s+pam_faillock\.so.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_system-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*account\s+required\s+pam_faillock\.so.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1" version="2">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1" version="2">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_system-auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1" version="2">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_password-auth:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_system-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=(\w*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=(\w*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_password-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=(\w*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1" version="2">
          <ind:filepath>/etc/pam.d/password-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=(\w*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_faillock_unlock_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="The password hashing algorithm should be set correctly in /etc/libuser.conf" id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1">
          <ind:filepath>/etc/libuser.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object comment="check /etc/pam.d/system-auth for correct settings" id="oval:ssg-object_pam_unix_sha512:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:symlink_object comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_emergency_service_emergency:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/emergency.target</ind:filepath>
          <ind:pattern operation="pattern match">^Requires=.*emergency.service</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for emergency.service in /etc/systemd/system" id="oval:ssg-object_no_custom_emergency_service:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.service$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for emergency.target in /etc/systemd/system" id="oval:ssg-object_no_custom_emergency_target:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^emergency.target$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/runlevel1.target</ind:filepath>
          <ind:pattern operation="pattern match">^Requires=.*rescue.service</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for rescue.service in /etc/systemd/system" id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^rescue.service$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="look for runlevel1.target in /etc/systemd/system" id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
          <unix:path operation="equals">/etc/systemd/system</unix:path>
          <unix:filename operation="pattern match">^runlevel1.target$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1" version="1">
          <ind:behaviors singleline="true" multiline="false"/>
          <ind:filepath>/etc/bashrc</ind:filepath>
          <ind:pattern operation="pattern match">^(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_after_time:obj:1" version="1">
          <ind:filepath>/etc/tmux.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*set\s+-g\s+lock-after-time\s+900\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_command:obj:1" version="1">
          <ind:filepath>/etc/tmux.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*set\s+-g\s+lock-command\s+vlock\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_no_tmux_in_shells:obj:1" version="1">
          <ind:filepath>/etc/shells</ind:filepath>
          <ind:pattern operation="pattern match">tmux$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_opensc_card_drivers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/opensc.*.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+card_drivers[\s]+=[\s]+(\S+);$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_opensc_nss_db:obj:1" version="1">
          <ind:filepath>/etc/pki/nssdb/pkcs11.txt</ind:filepath>
          <ind:pattern operation="pattern match">^library=opensc.*.so$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_force_opensc_card_drivers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/opensc.*.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]+force_card_driver[\s]+=[\s]+(\S+);$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
          <ind:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cert_policy[ ]=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/pam.d/smartcard-auth</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-obj_all_uids:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <ind:variable_object id="oval:ssg-obj_count_of_all_uids:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_uids:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_authorized_local_users:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_default_os_user:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
          <ind:filepath>/etc/default/useradd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^([^:]+):.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
        </unix:password_object>
        <unix:shadow_object id="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1" version="1">
          <unix:username operation="pattern match">.*</unix:username>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1</oval-def:filter>
        </unix:shadow_object>
        <ind:textfilecontent54_object id="oval:ssg-object_password_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_system_auth_pam_unix_rounds:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^.*:x:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^.*:[0-9]+:([0-9]+):</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^[^#]*\bnullok\b.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="lines starting with +" id="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1" version="1">
          <ind:filepath>/etc/shadow</ind:filepath>
          <ind:pattern operation="pattern match">^\+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="look for .netrc in /home" id="oval:ssg-object_no_netrc_files_home:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename operation="pattern match">^\.netrc$</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="/etc/securetty file exists" id="oval:ssg-object_etc_securetty_exists:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="no entries /etc/securetty" id="oval:ssg-object_no_direct_root_logins:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
          <ind:filepath>/etc/passwd</ind:filepath>
          <ind:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="serial ports /etc/securetty" id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^ttyS[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="virtual consoles /etc/securetty" id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1">
          <ind:filepath>/etc/securetty</ind:filepath>
          <ind:pattern operation="pattern match">^vc/[0-9]+$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="check /etc/pam.d/su for correct setting" id="oval:ssg-object_use_pam_wheel_for_su:obj:1" version="1">
          <ind:filepath>/etc/pam.d/su</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1" version="2">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)CREATE_HOME(?-i)[\s]+yes[\s]*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" comment="FAIL_DELAY value from /etc/login.defs" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_tmp_inst:obj:1" version="1">
          <unix:path>/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_var_tmp_tmp_inst:obj:1" version="1">
          <unix:path>/var/tmp/tmp-inst</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1" version="1">
          <ind:filepath>/etc/security/namespace.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3">
          <ind:filepath>/etc/profile</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3">
          <ind:path>/etc/profile.d</ind:path>
          <ind:filename operation="pattern match">^.*\.sh$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="home directories" id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
          <unix:path operation="equals">/home</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="exclude">oval:ssg-state_home_dirs_home_itself:ste:1</oval-def:filter>
          <oval-def:filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <unix:file_object comment="root's path directories with wrong group / other write permissions" id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1">
          <unix:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
          <ind:pid xsi:nil="true" datatype="int"/>
          <ind:name>PATH</ind:name>
        </ind:environmentvariable58_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" comment="Umask value from /etc/login.defs" version="1">
          <ind:filepath>/etc/login.defs</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*UMASK[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" comment="Umask value from /etc/profile" version="1">
          <ind:filepath>/etc/profile</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-e\s+2\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_directory-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0750:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_directory:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit directories" id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/audit files" id="oval:ssg-object_var_log_audit_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/var/log/audit</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_not_mode_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_system_privileged_commands:obj:1" comment="system files with setuid or setgid permission set" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">[a-z]+</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_dev_proc_sys_dirs:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1" version="1">
          <ind:filepath>/etc/audit/audisp-remote.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*remote_server[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1" version="1">
          <ind:filepath>/etc/audit/audisp-remote.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*transport[ ]+=[ ]+KRB5[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
          <ind:filepath>/etc/audit/plugins.d/syslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1" version="2">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_overflow_action:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_grub2_admin_username_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_unique_superuser:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)(?!root|admin|administrator)(?-i).*"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_grub2_password_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_superuser:obj:1" version="2">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_password_grubcfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)(?!root|admin|administrator)(?-i).*"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_superuser:obj:1" version="2">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_usercfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/user.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_grubcfg:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
          <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
          <ind:filepath>/etc/logwatch/conf/logwatch.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1" comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1" comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1" comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">^.*conf$</ind:filename>
          <ind:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfg_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfg_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfg_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfg_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfg_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_groupownership_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfo_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfo_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfo_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfo_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfo_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_owner_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" comment="rsyslog's $IncludeConfig directive and include() object values" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_include_config_regex:obj:1" comment="Make variable object from regex variable" version="1">
          <ind:var_ref>oval:ssg-var_rfp_include_config_regex:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_syslog_config:obj:1" comment="Make variable object for use" version="1">
          <ind:var_ref>oval:ssg-var_rfp_syslog_config:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_rfp_all_log_files:obj:1" comment="Filter out empty string" version="1">
          <oval-def:set>
            <oval-def:object_reference>oval:ssg-object_var_rfp_include_config_regex:obj:1</oval-def:object_reference>
            <oval-def:object_reference>oval:ssg-object_var_rfp_syslog_config:obj:1</oval-def:object_reference>
          </oval-def:set>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" comment="All rsyslog configuration files" version="1">
          <ind:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
          <oval-def:filter action="exclude">oval:ssg-state_permissions_ignore_include_paths:ste:1</oval-def:filter>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" comment="Various system log files" version="1">
          <unix:filepath datatype="string" var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_auth:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*auth\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*authpriv\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_daemon:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^.*daemon\.\*.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*daily[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1" version="2">
          <ind:filepath>/etc/logrotate.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
          <ind:filepath>/etc/cron.daily/logrotate</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
          <ind:filepath>/etc/rsyslog.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
          <ind:path>/etc/rsyslog.d</ind:path>
          <ind:filename operation="pattern match">.*</ind:filename>
          <ind:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls:obj:1" version="1">
          <ind:behaviors singleline="true"/>
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">0</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/network</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_network_nmcli_permissions:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/polkit-1/localauthority/20-org.d/.*$</ind:filepath>
          <ind:pattern operation="pattern match">^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
          <unix:name operation="pattern match">^.*$</unix:name>
          <oval-def:filter action="include">oval:ssg-state_promisc:ste:1</oval-def:filter>
        </unix:interface_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1">
          <ind:filepath>/etc/firewalld/firewalld.conf</ind:filepath>
          <ind:pattern operation="pattern match">^DefaultZone=drop$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Define default gateways" id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Enable privacy extensions on each interface" id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Set static IPv6 address on each interface" id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1">
          <ind:path>/etc/sysconfig/network-scripts</ind:path>
          <ind:filename operation="pattern match">ifcfg-.*</ind:filename>
          <ind:pattern operation="pattern match">^IPV6ADDR=.+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Test for udp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1">
          <ind:filepath>/etc/netconfig</ind:filepath>
          <ind:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Test for tcp6 based rpc services" id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1">
          <ind:filepath>/etc/netconfig</ind:filepath>
          <ind:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_wireless_disable_interfaces:obj:1" version="1">
          <ind:filepath>/proc/net/wireless</ind:filepath>
          <ind:pattern operation="pattern match">^\s*[-\w]+:</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_uid_zero:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_uid_is_not_root_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="only local directories" id="oval:ssg-object_only_local_directories:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_uid:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_uid_is_user_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local directories" id="oval:ssg-all_local_directories_gid:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="system.mapfiles" id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1">
          <unix:path>/boot</unix:path>
          <unix:filename operation="pattern match">^System\.map.*$</unix:filename>
        </unix:file_object>
        <unix:file_object comment="files with sgid set which are not owned by any RPM package" id="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" version="1" comment="all files with sgid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" operation="equals" var_check="all"/>
        </linux:rpmverifyfile_object>
        <unix:file_object comment="all files with sgid set" id="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="files with suid set which are not owned by any RPM package" id="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" version="1" comment="all files with suid set that come from a RPM package">
          <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" operation="equals" var_check="all"/>
        </linux:rpmverifyfile_object>
        <unix:file_object comment="all files with suid set" id="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="world writable" id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
          <unix:path operation="equals">/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="all local files" id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
          <unix:path>/</unix:path>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-state_file_permissions_ungroupowned:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
          <ind:filepath>/etc/group</ind:filepath>
          <ind:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:password_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
          <unix:username datatype="string" operation="pattern match">.*</unix:username>
        </unix:password_object>
        <unix:file_object comment="all local files" id="oval:ssg-file_permissions_unowned_object:obj:1" version="1">
          <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
          <unix:path>/</unix:path>
          <unix:filename operation="pattern match">.*</unix:filename>
          <oval-def:filter action="exclude">oval:ssg-file_permissions_unowned_userid_list_match:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library directories" id="oval:ssg-object_dir_group_ownership_lib_dir:obj:1" version="1">
          <unix:path operation="pattern match">(^\/lib(|64)\/|^\/usr\/lib(|64)\/)</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_group_owner_library_dirs_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library directories" id="oval:ssg-object_dir_ownership_lib_dir:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_library_dirs_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library directories" id="oval:ssg-dir_object_file_permissions_lib_dir:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-dir_state_perms_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-dir_perms_state_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="system commands files" id="oval:ssg-object_groupownership_system_commands_dirs:obj:1" version="1">
          <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary directories" id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary files" id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library directories" id="oval:ssg-object_file_ownership_lib_dir:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library files" id="oval:ssg-object_file_ownership_lib_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="binary files" id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-state_perms_binary_files_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library directories" id="oval:ssg-object_file_permissions_lib_dir:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-perms_state_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="library files" id="oval:ssg-object_file_permissions_lib_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</oval-def:filter>
          <oval-def:filter action="exclude">oval:ssg-perms_state_symlink:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="system-wide directories" id="oval:ssg-root_permissions_for_system_wide_library_files:obj:1" version="1">
          <unix:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-group_permissions_for_system_wide_files_are_not_root:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_grub2_nousb_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*GRUB_CMDLINE_LINUX=([^#]*).*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/\w.*$</linux:mount_point>
          <oval-def:filter action="include">oval:ssg-state_local_nodev:ste:1</oval-def:filter>
        </linux:partition_object>
        <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/var/tmp$</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object comment="look for the partition mount point in /etc/mtab" id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1">
          <ind:filepath>/etc/mtab</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1" version="1">
          <linux:mount_point operation="pattern match">^/tmp$</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1">
          <ind:filepath>/etc/systemd/coredump.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
          <ind:filepath>/etc/security/limits.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d_exists:obj:1" version="1">
          <ind:path>/etc/security/limits.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" comment="Umask value from /etc/init.d/functions" version="1">
          <ind:filepath>/etc/init.d/functions</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_kernel_exec_shield:obj:1" version="1">
          <unix:name>kernel.exec-shield</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
          <ind:filepath>/boot/grub2/grub.cfg</ind:filepath>
          <ind:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_NX_cpu_support:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_messages_nx_active:obj:1" version="1">
          <ind:filepath>/var/log/messages</ind:filepath>
          <ind:pattern operation="pattern match">^.+protection: disabled.+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_noexec_cmd_line:obj:1" version="1">
          <ind:filepath>/proc/cmdline</ind:filepath>
          <ind:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_package_kernel-PAE_installed:obj:1" version="1">
          <linux:name>kernel-PAE</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_PAE_NX_cpu_support:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags[\s]+:.*[\s]+pae[\s]+.*[\s]+nx[\s]+.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/kernel</ind:filepath>
          <ind:pattern operation="pattern match">^\s*DEFAULTKERNEL[\s]*=[\s]*kernel-PAE$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found" version="1">
          <ind:filepath>/etc/grub2.cfg</ind:filepath>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found" version="1">
          <ind:path>/etc/grub.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_dev_device_files:obj:1" comment="device files within /dev directory" version="1">
          <unix:behaviors recurse_direction="down"/>
          <unix:path operation="equals">/dev</unix:path>
          <unix:filename operation="pattern match">^.*$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_block_or_char_device_file:ste:1</oval-def:filter>
        </unix:file_object>
        <linux:selinuxsecuritycontext_object comment="device_t in /dev" id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_device_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object comment="unlabeled_t in /dev" id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1">
          <linux:filepath operation="equals" var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
          <oval-def:filter action="include">oval:ssg-state_selinux_dev_unlabeled_t:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <linux:selinuxsecuritycontext_object comment="find unconfined_service_t in /proc" id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1">
          <linux:behaviors max_depth="1" recurse_direction="down"/>
          <linux:path>/proc</linux:path>
          <linux:filename operation="pattern match">^.*$</linux:filename>
          <oval-def:filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</oval-def:filter>
        </linux:selinuxsecuritycontext_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUXTYPE=([\w]*)[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_cpuinfo_64_bit:obj:1" version="1">
          <ind:filepath>/proc/cpuinfo</ind:filepath>
          <ind:pattern operation="pattern match">^flags\s+:\s+(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_db:obj:1" comment="The binary system-wide dconf database with 'local' settings" version="1">
          <unix:filepath>/etc/dconf/db/local</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-obj_dconf_local_config:obj:1" comment="The dconf keyfile with 'local' settings" version="1">
          <unix:filepath operation="pattern match">^/etc/dconf/db/local.d/.*</unix:filepath>
        </unix:file_object>
        <ind:variable_object comment="All modified times of all keyfiles" id="oval:ssg-object_local_db_modified_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
          <ind:filepath>/etc/dconf/profile/user</ind:filepath>
          <ind:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-restart-buttons=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-user-list=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_enable_gnome_smartcard:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?enable-smartcard-authentication=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_smartcard:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/enable-smartcard-authentication$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?allowed-failures=3$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/distro.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/login-screen/allowed-failures$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1" version="1">
          <ind:filepath>/etc/gdm/custom.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1" comment="The configuration file /etc/gdm/custom.conf for gnome_gdm_disable_xdmcp" version="1">
          <unix:filepath operation="pattern match">^/etc/gdm/custom.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_gnome_disable_thumbnailers:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/thumbnailers]([^\n]*\n+)+?disable-all=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/thumbnailers/disable-all$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_creation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?disable-wifi-create=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/nm-applet/disable-wifi-create$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_wifi_notification:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?suppress-wireless-networks-available=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/nm-applet/suppress-wireless-networks-available$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?require-encryption=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?idle-activation-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/session]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_lock_delay:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^lock-delay[\s=]*uint32[\s]([^=\s]*)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-enabled=true$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?picture-uri=(string[\s])?\'\'$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?show-full-name-in-top-bar=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys]([^\n]*\n+)+?logout[\s]*=[\s]*''$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_sys_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/system/location]([^\n]*\n+)+?enabled=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_sys_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/system/location/enabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_clock_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/clocks]([^\n]*\n+)+?geolocation=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_clock_geolocation:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/clocks/geolocation$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_gnome_power_setting:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/power]([^\n]*\n+)+?active=false$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_power_setting_change:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/power/active$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/named.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-crypto_policies_current_file:obj:1" comment="crypto-policies current state" version="1">
          <unix:filepath>/etc/crypto-policies/state/current</unix:filepath>
        </unix:file_object>
        <unix:file_object id="oval:ssg-crypto_policies_config_file:obj:1" comment="crypto-policies config state" version="1">
          <unix:filepath datatype="string">/etc/crypto-policies/config</unix:filepath>
        </unix:file_object>
        <ind:variable_object comment="Crypto policy current file timestamp" id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1">
          <ind:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/config</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/state/current</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#)(\S+)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1">
          <unix:filepath>/etc/crypto-policies/back-ends/nss.config</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/gnutls.config</ind:filepath>
          <ind:pattern operation="pattern match">\+VERS-ALL:-VERS-DTLS0\.9:-VERS-SSL3\.0:-VERS-TLS1\.0:-VERS-TLS1\.1:-VERS-DTLS1\.0</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:symlink_object comment="kerberos crypto-policy configuration softlink" id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1">
          <unix:filepath>/etc/krb5.conf.d/crypto-policies</unix:filepath>
        </unix:symlink_object>
        <unix:symlink_object comment="kerberos crypto-policy backend softlink" id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1">
          <unix:filepath>/etc/crypto-policies/back-ends/krb5.config</unix:filepath>
        </unix:symlink_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/ipsec.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/pki/tls/openssl.cnf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/sysconfig/sshd</ind:filepath>
          <ind:pattern operation="pattern match">^\s*CRYPTO_POLICY\s*=.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1" version="1">
          <ind:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind:filepath>
          <ind:pattern operation="pattern match">^Match final all(?:.*
)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^Ciphers.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind:filepath>
          <ind:pattern operation="pattern match">^(?:.*\n)*\s*CRYPTO_POLICY=(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1" version="1">
          <ind:filepath>/etc/crypto-policies/back-ends/openssh.config</ind:filepath>
          <ind:pattern operation="pattern match">^MACs.*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_selinux_enforcing:obj:1" version="1">
          <ind:filepath>/etc/selinux/config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*enforcing[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
          <linux:name>McAfeeVSEForLinux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
          <linux:name>MFErt</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
          <linux:name>MFEcma</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
          <unix:path>/opt/McAfee/accm/bin</unix:path>
          <unix:filename>accm</unix:filename>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
          <unix:path>/opt/McAfee/auditengine/bin</unix:path>
          <unix:filename>auditmanager</unix:filename>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1">
          <ind:filepath>/etc/dracut.conf.d/40-fips.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind:var_ref>
        </ind:variable_object>
        <unix:file_object version="1" id="oval:ssg-object_etc_system_fips:obj:1">
          <unix:filepath>/etc/system-fips</unix:filepath>
        </unix:file_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1">
          <unix:name>crypto.fips_enabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind:pattern>
          <ind:instance operation="equals" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
        </unix:file_object>
        <unix:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditctl:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_auditd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_ausearch:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_aureport:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_autrace:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_audispd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/audispd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_rsyslogd:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_aide_verify_augenrules:obj:1" version="1">
          <ind:filepath>/etc/aide.conf</ind:filepath>
          <ind:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1">
          <ind:filepath>/etc/crontab</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1">
          <ind:path>/etc/cron.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron" id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1">
          <ind:filepath>/var/spool/cron/root</ind:filepath>
          <ind:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="run aide with cron.(daily|weekly)" id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1">
          <ind:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
          <linux:behaviors nomd5="false"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">^/(bin|sbin|lib|lib64|usr)/.+$</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <linux:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
          <linux:behaviors nomd5="true" noghostfiles="true"/>
          <linux:name operation="pattern match">.*</linux:name>
          <linux:epoch operation="pattern match">.*</linux:epoch>
          <linux:version operation="pattern match">.*</linux:version>
          <linux:release operation="pattern match">.*</linux:release>
          <linux:arch operation="pattern match">.*</linux:arch>
          <linux:filepath operation="pattern match">.*</linux:filepath>
          <oval-def:filter action="include">oval:ssg-state_files_fail_mode:ste:1</oval-def:filter>
        </linux:rpmverifyfile_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1" version="1">
          <ind:filepath>/etc/sudoers</ind:filepath>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1" version="1">
          <ind:path>/etc/sudoers.d</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_explicit_command_args:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_sudoers_no_command_negation:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-root_or_ALL_in_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_runas_spec:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_config:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
          <ind:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*apply_updates[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_apply_updates" version="1">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1">
          <ind:filepath>/etc/dnf/automatic.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*upgrade_type[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_security_updates_only" version="1">
          <unix:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
          <linux:name>gpg-pubkey</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" comment="gpgcheck set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" comment="localpkg_gpgcheck set in /etc/dnf/dnf.conf" version="1">
          <ind:filepath>/etc/dnf/dnf.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
          <ind:path>/etc/yum.repos.d</ind:path>
          <ind:filename operation="pattern match">.*</ind:filename>
          <ind:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^dictcheck[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^difok[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1" version="1">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*enforce_for_root[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^maxclassrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^maxrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^minclass[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^minlen[\s]*=[\s]*(\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3">
          <ind:filepath>/etc/security/pwquality.conf</ind:filepath>
          <ind:pattern operation="pattern match">^ucredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_passwords_pam_faillock_enforce_local:obj:1" version="1">
          <ind:filepath>/etc/security/faillock.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/run\/faillock\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/run\/faillock\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/log\/lastlog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/log\/lastlog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/log\/tallylog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w\s+\/var\/log\/tallylog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1"/>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_freq:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_local_events:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_log_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_name_format:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1" version="1">
          <unix:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/loader/entries/ostree-1-.*.conf</ind:filepath>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1" version="1">
          <ind:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</ind:filepath>
          <ind:pattern operation="pattern match">^options (.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1" version="1">
          <ind:filepath operation="pattern match">^/proc/cmdline</ind:filepath>
          <ind:pattern operation="pattern match">^BOOT_IMAGE(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[org/gnome/desktop/lockdown\].*(?:\n\s*[^[\s].*)*\n^\s*user-administration-disabled[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^\s*\[org/gnome/settings-daemon/peripherals/smartcard\].*(?:\n\s*[^[\s].*)*\n^\s*removal-action[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_prevent_user_removal-action:obj:1" version="1">
          <ind:path>/etc/dconf/db/local.d/locks</ind:path>
          <ind:filename operation="pattern match">^.*$</ind:filename>
          <ind:pattern operation="pattern match">^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_groupowner_backup_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_groupowner_backup_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_groupowner_backup_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_groupowner_backup_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-object_file_groupowner_efi_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/efi/EFI/fedora/grub.cfg</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_groupowner_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_groupowner_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_groupowner_etc_issue:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_groupowner_etc_motd:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_groupowner_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_groupowner_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_groupowner_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_groupowner_var_log:obj:1" version="1">
          <unix:path>/var/log/</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_groupowner_var_log_messages:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_owner_backup_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_owner_backup_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_owner_backup_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_owner_backup_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-object_file_owner_efi_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/efi/EFI/fedora/grub.cfg</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_owner_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_owner_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_owner_etc_issue:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_owner_etc_motd:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_owner_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_owner_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_owner_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_owner_var_log:obj:1" version="1">
          <unix:path>/var/log/</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_owner_var_log_messages:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="/etc/group-" id="oval:ssg-object_file_permissions_backup_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group-</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow-" id="oval:ssg-object_file_permissions_backup_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow-</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd-" id="oval:ssg-object_file_permissions_backup_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd-</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow-" id="oval:ssg-object_file_permissions_backup_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow-</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/efi/EFI/fedora/grub.cfg" id="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/efi/EFI/fedora/grub.cfg</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/auditd.conf" id="oval:ssg-object_file_permissions_etc_audit_auditd:obj:1" version="1">
          <unix:filepath>/etc/audit/auditd.conf</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/audit/rules.d/" id="oval:ssg-object_file_permissions_etc_audit_rulesd:obj:1" version="1">
          <unix:path>/etc/audit/rules.d/</unix:path>
          <unix:filename operation="pattern match">^.*rules$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/group" id="oval:ssg-object_file_permissions_etc_group:obj:1" version="1">
          <unix:filepath>/etc/group</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/gshadow" id="oval:ssg-object_file_permissions_etc_gshadow:obj:1" version="1">
          <unix:filepath>/etc/gshadow</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/issue" id="oval:ssg-object_file_permissions_etc_issue:obj:1" version="1">
          <unix:filepath>/etc/issue</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/motd" id="oval:ssg-object_file_permissions_etc_motd:obj:1" version="1">
          <unix:filepath>/etc/motd</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/passwd" id="oval:ssg-object_file_permissions_etc_passwd:obj:1" version="1">
          <unix:filepath>/etc/passwd</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/shadow" id="oval:ssg-object_file_permissions_etc_shadow:obj:1" version="1">
          <unix:filepath>/etc/shadow</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/boot/grub2/grub.cfg" id="oval:ssg-object_file_permissions_grub2_cfg:obj:1" version="1">
          <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/ssh/" id="oval:ssg-object_file_permissions_sshd_private_key:obj:1" version="1">
          <unix:path>/etc/ssh/</unix:path>
          <unix:filename operation="pattern match">^.*_key$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/etc/ssh/" id="oval:ssg-object_file_permissions_sshd_pub_key:obj:1" version="1">
          <unix:path>/etc/ssh/</unix:path>
          <unix:filename operation="pattern match">^.*.pub$</unix:filename>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/" id="oval:ssg-object_file_permissions_var_log:obj:1" version="1">
          <unix:path>/var/log/</unix:path>
          <unix:filename xsi:nil="true"/>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1</oval-def:filter>
        </unix:file_object>
        <unix:file_object comment="/var/log/messages" id="oval:ssg-object_file_permissions_var_log_messages:obj:1" version="1">
          <unix:filepath>/var/log/messages</unix:filepath>
          <oval-def:filter action="include">oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1</oval-def:filter>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument_grub_env:obj:1" version="1">
          <ind:filepath>/boot/grub2/grubenv</ind:filepath>
          <ind:pattern operation="pattern match">^kernelopts=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1" version="1">
          <linux:name>openssl-pkcs11</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" comment="kernel module atm disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of atm">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1" version="1" comment="kernel module atm disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1" version="1" comment="kernel module atm disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1" version="1" comment="kernel module atm disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" comment="kernel module can disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of can">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1" version="1" comment="kernel module can disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodules-load:obj:1" version="1" comment="kernel module can disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodules-load:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodprobed:obj:1" version="1" comment="kernel module can disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodprobed:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cramfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" comment="kernel module firewire-core disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of firewire-core">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of freevxfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfsplus">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of jffs2">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of rds">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1" version="1" comment="kernel module rds disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1" version="1" comment="kernel module rds disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1" version="1" comment="kernel module rds disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of squashfs">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of tipc">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of udf">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1" version="1" comment="kernel module udf disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1" version="1" comment="kernel module udf disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1" version="1" comment="kernel module udf disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of usb-storage">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_disabled:obj:1" version="1" comment="kernel module vfat disabled">
          <ind:path>/etc/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of vfat">
          <ind:filepath>/etc/modprobe.conf</ind:filepath>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /etc/modules-load.d">
          <ind:path>/etc/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /run/modules-load.d">
          <ind:path>/run/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
          <ind:path>/usr/lib/modules-load.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /run/modprobe.d">
          <ind:path>/run/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
          <ind:path>/usr/lib/modprobe.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1" version="1">
          <linux:mount_point>/dev/shm</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_home_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:partition_object id="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_partition_nodev_optional_yes:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_partition_noexec_optional_yes:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_GConf2_installed:obj:1" version="1">
          <linux:name>GConf2</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1" version="1">
          <linux:name>MFEhiplsm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1" version="1">
          <linux:name>abrt-addon-ccpp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1" version="1">
          <linux:name>abrt-addon-kerneloops</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1" version="1">
          <linux:name>abrt-addon-python</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-cli_removed:obj:1" version="1">
          <linux:name>abrt-cli</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1" version="1">
          <linux:name>abrt-plugin-logger</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1" version="1">
          <linux:name>abrt-plugin-rhtsupport</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1" version="1">
          <linux:name>abrt-plugin-sosreport</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_abrt_removed:obj:1" version="1">
          <linux:name>abrt</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_aide_installed:obj:1" version="1">
          <linux:name>aide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1" version="1">
          <linux:name>audispd-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1" version="1">
          <linux:name>audit-audispd-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_avahi_installed:obj:1" version="1">
          <linux:name>avahi</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1">
          <linux:name>bind</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_binutils_installed:obj:1" version="1">
          <linux:name>binutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cron_installed:obj:1" version="1">
          <linux:name>cron</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1" version="1">
          <linux:name>cryptsetup-luks</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1">
          <linux:name>dconf</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1">
          <linux:name>dnf-automatic</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_esc_installed:obj:1" version="1">
          <linux:name>esc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1">
          <linux:name>fapolicyd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gdm_removed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_geolite2-city_removed:obj:1" version="1">
          <linux:name>geolite2-city</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_geolite2-country_removed:obj:1" version="1">
          <linux:name>geolite2-country</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1" version="1">
          <linux:name>gnutls-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_gssproxy_removed:obj:1" version="1">
          <linux:name>gssproxy</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1" version="1">
          <linux:name>inetutils-telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_iprutils_removed:obj:1" version="1">
          <linux:name>iprutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1" version="1">
          <linux:name>krb5-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1" version="1">
          <linux:name>libcap-ng-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1">
          <linux:name>libreswan</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_libselinux_installed:obj:1" version="1">
          <linux:name>libselinux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_mcstrans_removed:obj:1" version="1">
          <linux:name>mcstrans</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_net-snmp_removed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nis_removed:obj:1" version="1">
          <linux:name>nis</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_nss-tools_installed:obj:1" version="1">
          <linux:name>nss-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_ntpdate_removed:obj:1" version="1">
          <linux:name>ntpdate</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openldap-clients_removed:obj:1" version="1">
          <linux:name>openldap-clients</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_opensc_installed:obj:1" version="1">
          <linux:name>opensc</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1" version="1">
          <linux:name>openscap-scanner</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_pam_ldap_removed:obj:1" version="1">
          <linux:name>pam_ldap</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils_installed:obj:1" version="1">
          <linux:name>policycoreutils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_prelink_removed:obj:1" version="1">
          <linux:name>prelink</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rear_installed:obj:1" version="1">
          <linux:name>rear</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1" version="1">
          <linux:name>rsyslog-gnutls</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_samba-common_removed:obj:1" version="1">
          <linux:name>samba-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1" version="1">
          <linux:name>scap-security-guide</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_screen_installed:obj:1" version="1">
          <linux:name>screen</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1">
          <linux:name>sendmail</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1" version="1">
          <linux:name>setroubleshoot-plugins</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1" version="1">
          <linux:name>setroubleshoot-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1" version="1">
          <linux:name>setroubleshoot</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1" version="1">
          <linux:name>sssd-ipa</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_syslogng_installed:obj:1" version="1">
          <linux:name>syslogng</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tar_installed:obj:1" version="1">
          <linux:name>tar</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1" version="1">
          <linux:name>telnetd-ssl</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_telnetd_removed:obj:1" version="1">
          <linux:name>telnetd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tmux_installed:obj:1" version="1">
          <linux:name>tmux</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_tuned_removed:obj:1" version="1">
          <linux:name>tuned</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1" version="1">
          <linux:name>vim-enhanced</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_installed:obj:1" version="1">
          <linux:name>vsftpd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_removed:obj:1" version="1">
          <linux:name>vsftpd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1" version="1">
          <linux:name>xorg-x11-server-common</linux:name>
        </linux:rpminfo_object>
        <linux:partition_object id="oval:ssg-object_mountboot_own_partition:obj:1" version="1">
          <linux:mount_point>/boot</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounthome_own_partition:obj:1" version="1">
          <linux:mount_point>/home</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountopt_own_partition:obj:1" version="1">
          <linux:mount_point>/opt</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountsrv_own_partition:obj:1" version="1">
          <linux:mount_point>/srv</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mounttmp_own_partition:obj:1" version="1">
          <linux:mount_point>/tmp</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountusr_own_partition:obj:1" version="1">
          <linux:mount_point>/usr</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_own_partition:obj:1" version="1">
          <linux:mount_point>/var</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log</linux:mount_point>
        </linux:partition_object>
        <linux:partition_object id="oval:ssg-object_mountvar_log_audit_own_partition:obj:1" version="1">
          <linux:mount_point>/var/log/audit</linux:mount_point>
        </linux:partition_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_atd:obj:1" comment="Retrieve the ActiveState property of atd" version="1">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1" comment="Retrieve the LoadState property of atd" version="1">
          <linux:unit operation="pattern match">^atd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_atd_package_at_removed:obj:1" version="1">
          <linux:name>at</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_auditd:obj:1" comment="Retrieve the ActiveState property of auditd" version="1">
          <linux:unit operation="pattern match">^auditd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_autofs:obj:1" comment="Retrieve the ActiveState property of autofs" version="1">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1" comment="Retrieve the LoadState property of autofs" version="1">
          <linux:unit operation="pattern match">^autofs\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1" version="1">
          <linux:name>autofs</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_bluetooth:obj:1" comment="Retrieve the ActiveState property of bluetooth" version="1">
          <linux:unit operation="pattern match">^bluetooth\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1" comment="Retrieve the LoadState property of bluetooth" version="1">
          <linux:unit operation="pattern match">^bluetooth\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1" version="1">
          <linux:name>bluez</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_chronyd:obj:1" comment="Retrieve the ActiveState property of chronyd" version="1">
          <linux:unit operation="pattern match">^chronyd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_cron:obj:1" comment="Retrieve the ActiveState property of cron" version="1">
          <linux:unit operation="pattern match">^cron\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1" version="1">
          <linux:name>cron</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_crond:obj:1" comment="Retrieve the ActiveState property of crond" version="1">
          <linux:unit operation="pattern match">^crond\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1" version="1">
          <linux:name>cronie</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_debug-shell:obj:1" comment="Retrieve the ActiveState property of debug-shell" version="1">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1" comment="Retrieve the LoadState property of debug-shell" version="1">
          <linux:unit operation="pattern match">^debug-shell\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_firewalld:obj:1" comment="Retrieve the ActiveState property of firewalld" version="1">
          <linux:unit operation="pattern match">^firewalld\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1">
          <linux:name>firewalld</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ip6tables:obj:1" comment="Retrieve the ActiveState property of ip6tables" version="1">
          <linux:unit operation="pattern match">^ip6tables\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1" version="1">
          <linux:name>iptables-ipv6</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_iptables:obj:1" comment="Retrieve the ActiveState property of iptables" version="1">
          <linux:unit operation="pattern match">^iptables\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1" version="1">
          <linux:name>iptables</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_netfs:obj:1" comment="Retrieve the ActiveState property of netfs" version="1">
          <linux:unit operation="pattern match">^netfs\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1" comment="Retrieve the LoadState property of netfs" version="1">
          <linux:unit operation="pattern match">^netfs\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1" version="1">
          <linux:name>netfs</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfs-server:obj:1" comment="Retrieve the ActiveState property of nfs-server" version="1">
          <linux:unit operation="pattern match">^nfs-server\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1" comment="Retrieve the LoadState property of nfs-server" version="1">
          <linux:unit operation="pattern match">^nfs-server\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfslock:obj:1" comment="Retrieve the ActiveState property of nfslock" version="1">
          <linux:unit operation="pattern match">^nfslock\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1" comment="Retrieve the LoadState property of nfslock" version="1">
          <linux:unit operation="pattern match">^nfslock\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ntp:obj:1" comment="Retrieve the ActiveState property of ntp" version="1">
          <linux:unit operation="pattern match">^ntp\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_ntpd:obj:1" comment="Retrieve the ActiveState property of ntpd" version="1">
          <linux:unit operation="pattern match">^ntpd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_pcscd:obj:1" comment="Retrieve the ActiveState property of pcscd" version="1">
          <linux:unit operation="pattern match">^pcscd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1" version="1">
          <linux:name>pcsc-lite</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rngd:obj:1" comment="Retrieve the ActiveState property of rngd" version="1">
          <linux:unit operation="pattern match">^rngd\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1">
          <linux:name>rng-tools</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcgssd:obj:1" comment="Retrieve the ActiveState property of rpcgssd" version="1">
          <linux:unit operation="pattern match">^rpcgssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1" comment="Retrieve the LoadState property of rpcgssd" version="1">
          <linux:unit operation="pattern match">^rpcgssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcidmapd:obj:1" comment="Retrieve the ActiveState property of rpcidmapd" version="1">
          <linux:unit operation="pattern match">^rpcidmapd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1" comment="Retrieve the LoadState property of rpcidmapd" version="1">
          <linux:unit operation="pattern match">^rpcidmapd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1" comment="Retrieve the ActiveState property of rpcsvcgssd" version="1">
          <linux:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1" comment="Retrieve the LoadState property of rpcsvcgssd" version="1">
          <linux:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1" version="1">
          <linux:name>nfs-utils</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rsyncd:obj:1" comment="Retrieve the ActiveState property of rsyncd" version="1">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1" comment="Retrieve the LoadState property of rsyncd" version="1">
          <linux:unit operation="pattern match">^rsyncd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1" version="1">
          <linux:name>rsync-daemon</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_rsyslog:obj:1" comment="Retrieve the ActiveState property of rsyslog" version="1">
          <linux:unit operation="pattern match">^rsyslog\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sshd:obj:1" comment="Retrieve the ActiveState property of sshd" version="1">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1" comment="Retrieve the LoadState property of sshd" version="1">
          <linux:unit operation="pattern match">^sshd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sssd:obj:1" comment="Retrieve the ActiveState property of sssd" version="1">
          <linux:unit operation="pattern match">^sssd\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1" comment="Retrieve the LoadState property of sssd" version="1">
          <linux:unit operation="pattern match">^sssd\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_syslog:obj:1" comment="Retrieve the ActiveState property of syslog" version="1">
          <linux:unit operation="pattern match">^syslog\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1" comment="Retrieve the LoadState property of syslog" version="1">
          <linux:unit operation="pattern match">^syslog\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1" version="1">
          <linux:name>rsyslog</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslogng_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslogng_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_syslogng:obj:1" comment="Retrieve the ActiveState property of syslogng" version="1">
          <linux:unit operation="pattern match">^syslogng\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_syslogng_package_syslogng_installed:obj:1" version="1">
          <linux:name>syslogng</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_not_running_systemd-coredump:obj:1" comment="Retrieve the ActiveState property of systemd-coredump" version="1">
          <linux:unit operation="pattern match">^systemd-coredump\.(service|socket)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1" comment="Retrieve the LoadState property of systemd-coredump" version="1">
          <linux:unit operation="pattern match">^systemd-coredump\.(service|socket)$</linux:unit>
          <linux:property>LoadState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_service_running_usbguard:obj:1" comment="Retrieve the ActiveState property of usbguard" version="1">
          <linux:unit operation="pattern match">^usbguard\.(socket|service)$</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1" version="1">
          <linux:name>usbguard</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_includes_config_files:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_default_not_overriden:obj:1" version="1">
          <ind:filepath>/etc/ssh/sshd_config</ind:filepath>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config.d</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir_default_not_overriden:obj:1" version="1">
          <ind:path>/etc/ssh/sshd_config</ind:path>
          <ind:filename operation="pattern match">.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_sssd_enable_certmap:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\^\[certmap\/\.\+\/\.\+\]\$[\s]*$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_noexec_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\bnoexec.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_requiretty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\brequiretty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_use_pty_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\buse_pty.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_logfile_sudoers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1" version="1">
          <unix:name>fs.protected_hardlinks</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1" version="1">
          <unix:name>fs.protected_symlinks</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1" version="1">
          <unix:name>fs.suid_dumpable</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1" version="1">
          <unix:name>kernel.core_pattern</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1" version="1">
          <unix:name>kernel.dmesg_restrict</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1" version="1">
          <unix:name>kernel.kexec_load_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1" version="1">
          <unix:name>kernel.kptr_restrict</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1" version="1">
          <unix:name>kernel.modules_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <unix:name>kernel.perf_cpu_time_max_percent</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <unix:name>kernel.perf_event_max_sample_rate</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1" version="1">
          <unix:name>kernel.perf_event_paranoid</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1" version="1">
          <unix:name>kernel.pid_max</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1" version="1">
          <unix:name>kernel.randomize_va_space</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1" version="1">
          <unix:name>kernel.sysrq</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <unix:name>kernel.unprivileged_bpf_disabled</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1" version="1">
          <unix:name>kernel.yama.ptrace_scope</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1" version="1">
          <unix:name>net.core.bpf_jit_harden</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.all.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.accept_source_route</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.log_martians</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.rp_filter</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.secure_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <unix:name>net.ipv4.conf.default.send_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <unix:name>net.ipv4.icmp_echo_ignore_broadcasts</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <unix:name>net.ipv4.icmp_ignore_bogus_error_responses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1" version="1">
          <unix:name>net.ipv4.ip_forward</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1" version="1">
          <unix:name>net.ipv4.ip_local_port_range</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1" version="1">
          <unix:name>net.ipv4.tcp_syncookies</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <unix:name>net.ipv6.conf.all.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_defrtr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_pinfo</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_ra_rtr_pref</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.accept_redirects</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.autoconf</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.disable_ipv6</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.max_addresses</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <unix:name>net.ipv6.conf.default.router_solicitations</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1" version="1">
          <unix:name>user.max_user_namespaces</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:sysctl_object id="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1" version="1">
          <unix:name>vm.mmap_min_addr</unix:name>
        </unix:sysctl_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
          <ind:filepath>/etc/sysctl.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/etc/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/run/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
          <ind:path>/usr/lib/sysctl.d</ind:path>
          <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
          <ind:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" comment="list of dependencies of multi-user.target" version="1">
          <linux:unit>multi-user.target</linux:unit>
        </linux:systemdunitdependency_object>
        <linux:systemdunitproperty_object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" comment="Retrieve the ActiveState property of dnf-automatic" version="1">
          <linux:unit operation="pattern match">dnf-automatic\.timer</linux:unit>
          <linux:property>ActiveState</linux:property>
        </linux:systemdunitproperty_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_faillock:obj:1" version="1">
          <ind:filepath>/etc/pam.d/system-auth</ind:filepath>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
          <ind:filepath var_ref="oval:ssg-var_pam_pwquality_config_path:var:1" var_check="at least one"/>
          <ind:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1">
          <ind:filepath>/usr/lib/systemd/system/auditd.service</ind:filepath>
          <ind:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1" version="1">
          <ind:filepath>/etc/audit/audit.rules</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" comment="log_group = root" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_is_set:obj:1" comment="log_group is set" version="1">
          <ind:filepath operation="equals">/etc/audit/auditd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object comment="Ensure more than one chronyd NTP server is set" id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind:filepath>
          <ind:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_grub2_default_exists:obj:1" version="1">
          <ind:filepath>/etc/default/grub</ind:filepath>
          <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
          <unix:filepath>/etc/debian_version</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^10.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^9.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
          <linux:name operation="pattern match">fedora-release.*</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
          <ind:filepath>/etc/system-release-cpe</ind:filepath>
          <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
          <linux:name>redhat-release-client</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
          <linux:name>redhat-release-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
          <linux:name>redhat-release-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
          <linux:name>redhat-release-computenode</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
          <linux:name>redhat-release-virtualization-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="check /etc/lsb-release file" id="oval:ssg-obj_lsb:obj:1" version="1">
          <unix:filepath>/etc/lsb-release</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.10\.19.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
          <ind:filepath>/etc/wrlinux-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.8\.0.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhosp10_release:obj:1" version="1">
          <linux:name>rhosp-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhosp13_release:obj:1" version="1">
          <linux:name>rhosp-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
          <linux:name>rhvm-appliance</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
          <linux:name>grub2-common</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
          <unix:filepath>/sys/firmware/opal</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
          <linux:name>libuser</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
          <linux:name>shadow-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
          <linux:name>nss-pam-ldapd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
          <linux:name>pam</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
          <linux:name>yum</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
          <linux:name>s390utils-base</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="Check file /.dockerenv" id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1">
          <unix:filepath datatype="string">/.dockerenv</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="Check file /run/.containerenv" id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1">
          <unix:filepath datatype="string">/run/.containerenv</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1" version="1">
          <ind:filepath>/etc/fstab</ind:filepath>
          <ind:pattern operation="pattern match" datatype="string" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
        </unix:file_object>
        <ind:variable_object id="oval:ssg-object_sshd_not_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_required:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1">
          <ind:var_ref>oval:ssg-sshd_required:var:1</ind:var_ref>
        </ind:variable_object>
        <linux:rpminfo_object id="oval:ssg-obj_openssh-server_version:obj:1" version="1">
          <linux:name>openssh-server</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="/etc/sssd/sssd.conf" id="oval:ssg-object_sssd_conf_exists:obj:1" version="1">
          <unix:filepath>/etc/sssd/sssd.conf</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/sys/firmware/efi" id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1">
          <unix:path>/sys/firmware/efi</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1"/>
        <unix:uname_object comment="32 bit architecture" id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1"/>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_usbguard_rules_nonempty:obj:1" version="1">
          <ind:filepath operation="pattern match">^/etc/usbguard/(rules|rules\.d/.*)\.conf$</ind:filepath>
          <ind:pattern operation="pattern match">^.*\S+.*$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_removable_partition:var:1</ind:var_ref>
        </ind:variable_object>
        <ind:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
          <ind:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind:var_ref>
        </ind:variable_object>
      </oval-def:objects>
      <oval-def:states>
        <ind:textfilecontent54_state id="oval:ssg-state_root_mail_alias:ste:1" version="1" comment="root email alias">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_postfix_root_mail_alias:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_port_value_0:ste:1" version="1">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_cmdport_value_0:ste:1" version="1">
          <ind:subexpression>0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_time_service_set_maxpoll:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_time_service_set_maxpoll:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_server_has_maxpoll:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">maxpoll \d+</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_chronyd_run_as_chrony_user:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^["]?.*-u chrony.*["]?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_sshd_disable_compression:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_idle_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of ClientAliveInterval in seconds" id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_set_keepalive:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of MaxAuthTries" id="oval:ssg-state_maxauthtries_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-sshd_max_auth_tries_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of MaxAuthTries" id="oval:ssg-state_maxauthtries_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="upper bound of MaxSessions in number of sessions" id="oval:ssg-state_maxsessions_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sshd_max_sessions:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of MaxSessions in number of sessions" id="oval:ssg-state_maxsessions_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal">10</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal">30</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal">100</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_sshd_priv_separation:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of certificate_verification" id="oval:ssg-state_sssd_certificate_verification:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_sssd_certificate_verification_digest_function:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of memcache_timeout setting" id="oval:ssg-state_sssd_memcache_timeout:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sssd_memcache_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sssd_user_value:ste:1" comment="value of user setting" version="1">
          <ind:subexpression>sssd</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="value of ssh_known_hosts_timeout setting" id="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_usbguard_auditbackend:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^LinuxAudit$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:symlink_state comment="default.target is linked to multi-user.target" id="oval:ssg-state_disable_xwindows_runlevel_target:ste:1" version="1">
          <unix:filepath>/etc/systemd/system/default.target</unix:filepath>
          <unix:canonical_path operation="pattern match">^(/usr)?/lib/systemd/system/multi-user.target$</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_issue:ste:1" version="1">
          <ind:subexpression datatype="string" var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_banner_etc_motd:ste:1" version="1">
          <ind:subexpression datatype="string" var_ref="oval:ssg-login_banner_text:var:1" operation="pattern match"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_remember:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1" version="2">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1" version="2">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_unlock_time_greater_or_equal_than_ext_var:ste:1" version="2">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^0$|^never$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_var_faillock_unlock_time_is_never:ste:1" version="1">
          <ind:value datatype="int" operation="equals">0</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state comment="upper bound of password_pam_retry" id="oval:ssg-state_password_pam_retry_upper_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_retry:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state comment="lower bound of password_pam_retry" id="oval:ssg-state_password_pam_retry_lower_bound:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
          <ind:value operation="equals" datatype="string" var_ref="oval:ssg-var_password_hashing_algorithm:var:1"/>
        </ind:variable_state>
        <unix:symlink_state comment="Disable Ctrl-Alt-Del key sequence override exists" id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1">
          <unix:filepath>/etc/systemd/system/ctrl-alt-del.target</unix:filepath>
          <unix:canonical_path>/dev/null</unix:canonical_path>
        </unix:symlink_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_bashrc_exec_tmux:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_opensc_card_drivers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_smartcard_drivers:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_force_opensc_card_drivers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_smartcard_drivers:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
          <ind:subexpression operation="pattern match">^.*ocsp_on.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_no_duplicate_uids:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_uids:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_default_os_user:ste:1" version="1" comment="The user root is always allowed as default opering system user">
          <ind:subexpression operation="pattern match">^root$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_authorized_local_users:ste:1" version="1" comment="authorized usernames required by the installed software groups and applications">
          <ind:subexpression operation="pattern match" var_ref="oval:ssg-var_accounts_authorized_local_users_regex:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
          <ind:subexpression operation="greater than" datatype="int">-1</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
          <ind:value var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" operation="equals" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
          <ind:value operation="less than or equal" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
          <ind:value operation="greater than or equal" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" datatype="int" var_check="at least one"/>
        </ind:variable_state>
        <unix:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
          <unix:password operation="pattern match">x|\*</unix:password>
        </unix:password_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1" version="1">
          <unix:password operation="pattern match">^(!|!!|\*)$</unix:password>
        </unix:shadow_state>
        <unix:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1" version="1">
          <unix:encrypt_method operation="equals">SHA-512</unix:encrypt_method>
        </unix:shadow_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_auth_pam_unix_rounds:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1" version="1">
          <ind:value datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-var_password_auth_default_hashing_rounds:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_system_auth_pam_unix_rounds:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1" version="1">
          <ind:value datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-var_system_auth_default_hashing_rounds:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one" datatype="string"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_zero:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_less_than_sys_uid_min:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than" var_ref="oval:ssg-variable_sys_uid_min_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1" version="1">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-variable_sys_uid_max_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_accounts_fail_delay:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
          <ind:subexpression operation="less than or equal" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_tmp_inst:ste:1" version="1">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_var_tmp_tmp_inst:ste:1" version="1">
          <unix:type>directory</unix:type>
          <unix:uread datatype="boolean">false</unix:uread>
          <unix:uwrite datatype="boolean">false</unix:uwrite>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="2">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_accounts_tmout:var:1"/>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
          <unix:path operation="equals">/home</unix:path>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state comment="group or other has write privilege" id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="symbolic link" id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <ind:environmentvariable58_state comment="starts with colon or period" id="oval:ssg-state_begins_colon_period:ste:1" version="1">
          <ind:value operation="pattern match">^[:\.]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="colon twice in a row" id="oval:ssg-state_contains_double_colon:ste:1" version="1">
          <ind:value operation="pattern match">::</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="period twice in a row" id="oval:ssg-state_contains_double_period:ste:1" version="1">
          <ind:value operation="pattern match">\.\.</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="ends with colon or period" id="oval:ssg-state_ends_colon_period:ste:1" version="1">
          <ind:value operation="pattern match">[:\.]$</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="begins with a slash" id="oval:ssg-state_begins_slash:ste:1" version="1">
          <ind:value operation="pattern match">^[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:environmentvariable58_state comment="elements begin with a slash" id="oval:ssg-state_contains_relative_path:ste:1" version="1">
          <ind:value operation="pattern match">[^\\]:[^/]</ind:value>
        </ind:environmentvariable58_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1"/>
        </ind:variable_state>
        <unix:file_state id="oval:ssg-state_not_mode_0700:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0750:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
          <unix:user_id datatype="int" operation="equals">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_dev_proc_sys_dirs:ste:1" version="1">
          <unix:filepath operation="pattern match">^\/(dev|proc|sys)\/.*$</unix:filepath>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1" version="1">
          <ind:subexpression operation="not equal" datatype="string" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="all"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_audit_rules_privileged_commands:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="at least one"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" var_check="at least one"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1" version="1">
          <ind:value operation="equals" datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" var_check="at least one"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_audispd_remote_server:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_error_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_full_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-var_auditd_action_mail_acct:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_max_log_file:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_num_logs:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
          <ind:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1" version="1">
          <ind:subexpression operation="greater than or equal" var_ref="oval:ssg-var_auditd_space_left_percentage:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_overflow_action:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)(syslog|single|halt)(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_groupownership_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_owner_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_permissions_ignore_include_paths:ste:1" comment="ignore" version="1">
          <ind:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind:text>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rsyslog_remote_tls:ste:1" comment="value of omfwd action" version="1">
          <ind:subexpression datatype="string" operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_network_nmcli_permissions:ste:1" version="1">
          <ind:subexpression datatype="string">ResultActive=auth_admin</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
          <unix:flag datatype="string" entity_check="at least one" operation="equals">PROMISC</unix:flag>
        </unix:interface_state>
        <unix:file_state comment="uid greater than 0 and world writable" id="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1" version="1">
          <unix:user_id datatype="int" operation="greater than">0</unix:user_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="uid greater than or equal to 1000 and world writable" id="oval:ssg-state_uid_is_user_and_world_writable:ste:1" version="1">
          <unix:user_id datatype="int" operation="greater than or equal">1000</unix:user_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state comment="gid greater than or equal to 1000 and world writable" id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1">
          <unix:group_id datatype="int" operation="greater than or equal">1000</unix:group_id>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
          <unix:user_id datatype="int" operation="equals">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
          <unix:suid datatype="boolean">false</unix:suid>
          <unix:sgid datatype="boolean">false</unix:sgid>
          <unix:sticky datatype="boolean">false</unix:sticky>
          <unix:uexec datatype="boolean">false</unix:uexec>
          <unix:gread datatype="boolean">false</unix:gread>
          <unix:gwrite datatype="boolean">false</unix:gwrite>
          <unix:gexec datatype="boolean">false</unix:gexec>
          <unix:oread datatype="boolean">false</unix:oread>
          <unix:owrite datatype="boolean">false</unix:owrite>
          <unix:oexec datatype="boolean">false</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1" version="1">
          <unix:sgid datatype="boolean">true</unix:sgid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1" version="1">
          <unix:suid datatype="boolean">true</unix:suid>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1" version="1">
          <unix:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
          <unix:type operation="equals">regular</unix:type>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
          <unix:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
          <unix:filepath operation="pattern match">^/proc/.*$</unix:filepath>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
          <unix:filepath operation="pattern match">^/sys/.*$</unix:filepath>
        </unix:file_state>
        <unix:file_state comment="Files that are owned by a group." id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1">
          <unix:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
          <unix:user_id var_check="at least one" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" datatype="int"/>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_group_owner_library_dirs_not_root:ste:1" version="1">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_library_dirs_not_root:ste:1" version="1">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-dir_state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-dir_perms_state_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1" version="1">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_owner_libraries_not_root:ste:1" version="1">
          <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-perms_state_symlink:ste:1" version="1">
          <unix:type operation="equals">symbolic link</unix:type>
        </unix:file_state>
        <unix:file_state id="oval:ssg-group_permissions_for_system_wide_files_are_not_root:ste:1" version="1">
          <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_nousb_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^.*\bnousb\b.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
          <linux:device operation="pattern match">^/dev/.*$</linux:device>
          <linux:mount_options datatype="string" entity_check="all" operation="not equal">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1" version="1">
          <linux:device datatype="string" entity_check="at least one" operation="equals" var_ref="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1"/>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)0(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)none(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_core_dumps_limits_d:ste:1" version="1">
          <ind:subexpression operation="equals">0</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
          <ind:value datatype="int" operation="bitwise and" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1"/>
        </ind:variable_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_kernel_exec_shield:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:file_state id="oval:ssg-state_block_or_char_device_file:ste:1" version="1" comment="device files">
          <unix:type operation="pattern match">^(block|character) special$</unix:type>
        </unix:file_state>
        <linux:selinuxsecuritycontext_state comment="device_t label" id="oval:ssg-state_selinux_dev_device_t:ste:1" version="1">
          <linux:type datatype="string" operation="equals">device_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state comment="unlabeled_t label" id="oval:ssg-state_selinux_dev_unlabeled_t:ste:1" version="1">
          <linux:type datatype="string" operation="equals">unlabeled_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <linux:selinuxsecuritycontext_state comment="state unconfined_service_t" id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1">
          <linux:type datatype="string" operation="equals">unconfined_service_t</linux:type>
        </linux:selinuxsecuritycontext_state>
        <ind:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_policy_name:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_check="all" var_ref="oval:ssg-var_selinux_state:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_cpuinfo_64_bit:ste:1" version="1">
          <ind:subexpression operation="pattern match">\blm\b</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(x86_64|aarch64|ppc64le|s390x)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_local_db_is_up_to_date:ste:1" version="1">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^false$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1">
          <ind:subexpression datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-inactivity_timeout_value:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_screensaver_lock_delay_setting:ste:1" version="1">
          <ind:subexpression datatype="int" operation="equals" var_check="all" var_ref="oval:ssg-var_screensaver_lock_delay:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1" version="1">
          <ind:value datatype="int" operation="less than or equal" var_check="all" var_ref="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1"/>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy_current:ste:1" version="1">
          <ind:subexpression operation="equals" var_check="all" var_ref="oval:ssg-var_system_crypto_policy:var:1"/>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1" version="1">
          <ind:value datatype="string" operation="equals" var_ref="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1"/>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1" version="1">
          <ind:value datatype="string" operation="equals">/etc/crypto-policies/back-ends/krb5.config</ind:value>
        </ind:variable_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^final all$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^512M 1h$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^hmac-sha2-512,hmac-sha2-256$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1" version="1">
          <ind:text var_ref="oval:ssg-sshd_ciphers_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_harden_sshd_crypto_policy:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^'-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1" version="1">
          <ind:text var_ref="oval:ssg-sshd_macs_crypto:var:1" operation="equals"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_enable_dracut_fips_module:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals">fips</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state comment="variable value is set to 'FIPS' or 'FIPS:modifier', where the modifier corresponds to a crypto policy module that further restricts the modified crypto policy." id="oval:ssg-ste_system_crypto_policy_value:ste:1" version="2">
          <ind:value operation="pattern match" datatype="string">^FIPS(:(OSPP|NO-SHA1|NO-CAMELLIA))?$</ind:value>
        </ind:variable_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_aide_check_attributes:ste:1" version="1">
          <ind:subexpression operation="equals">p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1" operator="AND">
          <linux:md5_differs>fail</linux:md5_differs>
          <linux:configuration_file datatype="boolean">false</linux:configuration_file>
          <linux:ghost_file datatype="boolean">false</linux:ghost_file>
        </linux:rpmverifyfile_state>
        <linux:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
          <linux:mode_differs>fail</linux:mode_differs>
        </linux:rpmverifyfile_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_apply_updates:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dnf-automatic_security_updates_only:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^security$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1" version="1">
          <linux:release>601c49ca</linux:release>
          <linux:version>9867c58f</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1" version="1">
          <linux:release>5f2c0192</linux:release>
          <linux:version>45719a39</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9570ff31-5e3006fb:ste:1" version="1">
          <linux:release>5e3006fb</linux:release>
          <linux:version>9570ff31</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dcredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_dcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_dictcheck:ste:1" version="3">
          <ind:subexpression datatype="int" operation="equals" var_ref="oval:ssg-var_password_pam_dictcheck:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_difok:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_difok:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_lcredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_lcredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_maxrepeat:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minclass:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minclass:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="3">
          <ind:subexpression datatype="int" operation="greater than or equal" var_ref="oval:ssg-var_password_pam_minlen:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ocredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ocredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_password_pam_ucredit:ste:1" version="3">
          <ind:subexpression datatype="int" operation="less than or equal" var_ref="oval:ssg-var_password_pam_ucredit:var:1"/>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_freq:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)50(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_local_events:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_log_format:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)ENRICHED(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_name_format:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)hostname(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_auditd_write_logs:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?i)yes(?-i)$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^true$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^'lock-screen'$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_disable_host_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_group_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_group_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_gshadow_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_issue_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_motd_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_passwd_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_etc_shadow_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_grub2_cfg_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_groupowner_var_log_messages_gid_0:ste:1" version="1">
          <unix:group_id datatype="int">0</unix:group_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_group_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_passwd_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_backup_etc_shadow_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_group_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_gshadow_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_issue_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_motd_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_passwd_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_etc_shadow_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_grub2_cfg_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_owner_var_log_messages_uid_0:ste:1" version="1">
          <unix:user_id datatype="int">0</unix:user_id>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uread datatype="boolean">true</unix:uread>
          <unix:uwrite datatype="boolean">true</unix:uwrite>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uread datatype="boolean">true</unix:uread>
          <unix:uwrite datatype="boolean">true</unix:uwrite>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uread datatype="boolean">true</unix:uread>
          <unix:uwrite datatype="boolean">true</unix:uwrite>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uread datatype="boolean">true</unix:uread>
          <unix:uwrite datatype="boolean">true</unix:uwrite>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gread datatype="boolean">true</unix:gread>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:owrite datatype="boolean">true</unix:owrite>
        </unix:file_state>
        <unix:file_state id="oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1" operator="OR" version="2">
          <unix:suid datatype="boolean">true</unix:suid>
          <unix:sgid datatype="boolean">true</unix:sgid>
          <unix:sticky datatype="boolean">true</unix:sticky>
          <unix:uexec datatype="boolean">true</unix:uexec>
          <unix:gwrite datatype="boolean">true</unix:gwrite>
          <unix:gexec datatype="boolean">true</unix:gexec>
          <unix:oread datatype="boolean">true</unix:oread>
          <unix:owrite datatype="boolean">true</unix:owrite>
          <unix:oexec datatype="boolean">true</unix:oexec>
        </unix:file_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_iommu_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?iommu=force(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_ipv6_disable_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?ipv6\.disable=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_page_poison_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?page_poison=1(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_pti_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?pti=on(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_slub_debug_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?slub_debug=P(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_grub2_vsyscall_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^(?:.*\s)?vsyscall=none(?:\s.*)?$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noauto</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_home_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nodev,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?noexec,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
          <ind:subexpression operation="pattern match" datatype="string">^.*,?nosuid,?.*</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:partition_state id="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_partition_nodev_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nodev</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_partition_noexec_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">noexec</linux:mount_options>
        </linux:partition_state>
        <linux:partition_state id="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1" version="1">
          <linux:mount_options datatype="string" entity_check="at least one" operation="equals">nosuid</linux:mount_options>
        </linux:partition_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_atd:ste:1" version="1" comment="atd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_atd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">auditd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_socket_on:ste:1" comment="auditd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">auditd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_auditd:ste:1" version="1" comment="auditd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_autofs:ste:1" version="1" comment="autofs is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_bluetooth:ste:1" version="1" comment="bluetooth is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" comment="chronyd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">chronyd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_socket_on:ste:1" comment="chronyd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">chronyd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_chronyd:ste:1" version="1" comment="chronyd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">cron.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_cron_socket_on:ste:1" comment="cron listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">cron.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_cron:ste:1" version="1" comment="cron is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" comment="crond listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">crond.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_crond_socket_on:ste:1" comment="crond listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">crond.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_crond:ste:1" version="1" comment="crond is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_debug-shell:ste:1" version="1" comment="debug-shell is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" comment="firewalld listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">firewalld.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_socket_on:ste:1" comment="firewalld listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">firewalld.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_firewalld:ste:1" version="1" comment="firewalld is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_on:ste:1" comment="ip6tables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ip6tables.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_socket_on:ste:1" comment="ip6tables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ip6tables.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ip6tables:ste:1" version="1" comment="ip6tables is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_on:ste:1" comment="iptables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">iptables.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_socket_on:ste:1" comment="iptables listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">iptables.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_iptables:ste:1" version="1" comment="iptables is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_netfs:ste:1" version="1" comment="netfs is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfs-server:ste:1" version="1" comment="nfs-server is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfslock:ste:1" version="1" comment="nfslock is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_on:ste:1" comment="ntp listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntp.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_socket_on:ste:1" comment="ntp listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntp.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ntp:ste:1" version="1" comment="ntp is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntpd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_socket_on:ste:1" comment="ntpd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">ntpd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_ntpd:ste:1" version="1" comment="ntpd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_on:ste:1" comment="pcscd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">pcscd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_socket_on:ste:1" comment="pcscd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">pcscd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_pcscd:ste:1" version="1" comment="pcscd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_on:ste:1" comment="rngd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rngd.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_socket_on:ste:1" comment="rngd listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rngd.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rngd:ste:1" version="1" comment="rngd is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcgssd:ste:1" version="1" comment="rpcgssd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcidmapd:ste:1" version="1" comment="rpcidmapd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1" version="1" comment="rpcsvcgssd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_rsyncd:ste:1" version="1" comment="rsyncd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rsyslog.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_socket_on:ste:1" comment="rsyslog listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">rsyslog.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_rsyslog:ste:1" version="1" comment="rsyslog is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_sshd:ste:1" version="1" comment="sshd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_sssd:ste:1" version="1" comment="sssd is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_syslog:ste:1" version="1" comment="syslog is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslogng_on:ste:1" comment="syslogng listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">syslogng.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_syslogng_socket_on:ste:1" comment="syslogng listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">syslogng.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_syslogng:ste:1" version="1" comment="syslogng is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_not_running_systemd-coredump:ste:1" version="1" comment="systemd-coredump is not running">
          <linux:value>inactive</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1" version="1" comment="LoadState is set to masked">
          <linux:value>masked</linux:value>
        </linux:systemdunitproperty_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_on:ste:1" comment="usbguard listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">usbguard.service</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_socket_on:ste:1" comment="usbguard listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">usbguard.socket</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_service_running_usbguard:ste:1" version="1" comment="usbguard is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^prohibit-password$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^no$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^/etc/issue$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^0$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^INFO$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^VERBOSE$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^yes$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_logfile_sudoers:ste:1" version="1">
          <ind:subexpression datatype="string" operation="equals" var_ref="oval:ssg-var_sudo_logfile:var:1"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1" version="1">
          <unix:value datatype="string" operation="equals">|/bin/false</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1" version="1">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1" version="1">
          <unix:value datatype="int" operation="equals">2</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1" version="1">
          <unix:value datatype="string" operation="pattern match">32768\s*65535</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
          <unix:value datatype="int" operation="equals">1</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
          <unix:value datatype="int" operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1"/>
        </unix:sysctl_state>
        <ind:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
          <ind:subexpression operation="equals" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" datatype="int"/>
        </ind:textfilecontent54_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1" version="1">
          <unix:value datatype="int" operation="equals">0</unix:value>
        </unix:sysctl_state>
        <unix:sysctl_state id="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1" version="1">
          <unix:value datatype="int" operation="equals">65536</unix:value>
        </unix:sysctl_state>
        <linux:systemdunitdependency_state id="oval:ssg-state_systemd_dnf-automatic_on:ste:1" comment="dnf-automatic listed at least once in the dependencies" version="1">
          <linux:dependency entity_check="at least one">dnf-automatic.timer</linux:dependency>
        </linux:systemdunitdependency_state>
        <linux:systemdunitproperty_state id="oval:ssg-state_timer_running_dnf-automatic:ste:1" version="1" comment="dnf-automatic is running">
          <linux:value>active</linux:value>
        </linux:systemdunitproperty_state>
        <ind:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^true|"true"$</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
          <ind:subexpression>8</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
          <linux:name operation="pattern match">openSUSE-release</linux:name>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
          <linux:version operation="pattern match">^42.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
          <ind:subexpression operation="pattern match">rhcos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
          <ind:subexpression operation="pattern match">4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
          <linux:version operation="pattern match">^8.0*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
          <linux:version operation="pattern match">^8.1*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
          <linux:version operation="pattern match">^8.2*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
          <linux:version operation="pattern match">^8.3*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
          <linux:version operation="pattern match">^8.4*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
          <linux:version operation="pattern match">^8.5*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
          <linux:version operation="pattern match">^8.6*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
          <linux:version operation="pattern match">^8.7*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
          <linux:version operation="pattern match">^8.8*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
          <linux:version operation="pattern match">^8.9*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
          <linux:version operation="pattern match">^8.10*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:4.4</linux:evr>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhosp10_release:ste:1" version="1">
          <linux:version operation="pattern match">^10.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhosp13_release:ste:1" version="1">
          <linux:version operation="pattern match">^13.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
          <linux:version operation="pattern match">^4.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^s390x$</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:variable_state id="oval:ssg-state_sshd_not_required:ste:1" version="1">
          <ind:value operation="equals" datatype="int">1</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_required:ste:1" version="1">
          <ind:value operation="equals" datatype="int">2</ind:value>
        </ind:variable_state>
        <ind:variable_state id="oval:ssg-state_sshd_requirement_unset:ste:1" version="1">
          <ind:value operation="equals" datatype="int">0</ind:value>
        </ind:variable_state>
        <linux:rpminfo_state id="oval:ssg-state_openssh-server_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:7.4</linux:evr>
        </linux:rpminfo_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_aarch_64:ste:1" version="1">
          <unix:processor_type operation="equals">aarch64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_s390_64:ste:1" version="1">
          <unix:processor_type operation="equals">s390x</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="32 bit architecture" id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1">
          <unix:processor_type operation="equals">i686</unix:processor_type>
        </unix:uname_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1">
          <unix:processor_type operation="equals">x86_64</unix:processor_type>
        </unix:uname_state>
        <ind:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
          <ind:value operation="equals">/dev/cdrom</ind:value>
        </ind:variable_state>
      </oval-def:states>
      <oval-def:variables>
        <oval-def:external_variable comment="expected email alias" datatype="string" id="oval:ssg-var_postfix_root_mail_alias:var:1" version="1"/>
        <oval-def:external_variable comment="maxpoll value" datatype="int" id="oval:ssg-var_time_service_set_maxpoll:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for the desired value of Compression" datatype="string" id="oval:ssg-var_sshd_disable_compression:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-sshd_line_regex:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*RekeyLimit[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_size:var:1"/>
            <oval-def:literal_component>[\s]+</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_rekey_limit_time:var:1"/>
            <oval-def:literal_component>[\s]*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Size component of the rekey limit" datatype="string" id="oval:ssg-var_rekey_limit_size:var:1" version="1"/>
        <oval-def:external_variable comment="Time component of the rekey limit" datatype="string" id="oval:ssg-var_rekey_limit_time:var:1" version="1"/>
        <oval-def:external_variable comment="timeout value" datatype="int" id="oval:ssg-sshd_idle_timeout_value:var:1" version="1"/>
        <oval-def:external_variable comment="ClientAliveCountMax value" datatype="int" id="oval:ssg-var_sshd_set_keepalive:var:1" version="1"/>
        <oval-def:external_variable comment="maxauthtries value" datatype="int" id="oval:ssg-sshd_max_auth_tries_value:var:1" version="1"/>
        <oval-def:external_variable comment="maxsessions value" datatype="int" id="oval:ssg-var_sshd_max_sessions:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for the desired value of UsePrivilegeSeparation" datatype="string" id="oval:ssg-var_sshd_priv_separation:var:1" version="1"/>
        <oval-def:external_variable comment="certificate_verification value" datatype="string" id="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" version="1"/>
        <oval-def:external_variable comment="memcache_timeout value" datatype="int" id="oval:ssg-var_sssd_memcache_timeout:var:1" version="1"/>
        <oval-def:external_variable comment="var_sssd_ssh_known_hosts_timeout value" datatype="int" id="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" version="1"/>
        <oval-def:external_variable comment="warning banner text variable" datatype="string" id="oval:ssg-login_banner_text:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-pwhistory_line_regex_password_auth:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_remember:var:1" version="1"/>
        <oval-def:external_variable comment="control flag for pwhistory module" datatype="string" id="oval:ssg-var_password_pam_remember_control_flag:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-pwhistory_line_regex_system_auth:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^\s*password\s+(?:</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
            <oval-def:literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords that should be remembered" datatype="int" id="oval:ssg-var_password_pam_unix_remember:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_system-auth:var:1" datatype="string" version="1" comment="Regex containing skipped lines">
          <oval-def:concat>
            <oval-def:literal_component datatype="string">pam_unix(?:.*[\n](?:.*[\n]){</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_system-auth:obj:1"/>
            <oval-def:literal_component datatype="string">})(?:.*[\n])*auth.*pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_password-auth:var:1" datatype="string" version="1" comment="Regex containing skipped lines">
          <oval-def:concat>
            <oval-def:literal_component datatype="string">^[^#]*pam_unix(?:.*[\n](?:.*[\n]){</oval-def:literal_component>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_password-auth:obj:1"/>
            <oval-def:literal_component datatype="string">})(?:.*[\n])*auth.*pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" datatype="int" comment="number of failed login attempts allowed" version="1"/>
        <oval-def:external_variable comment="number of failed login attempts allowed" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="2"/>
        <oval-def:external_variable comment="lockout time for failed password attempts" datatype="int" id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="2"/>
        <oval-def:external_variable comment="External variable for pam_pwquality retry" datatype="int" id="oval:ssg-var_password_pam_retry:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="defined hashing algorithm" datatype="string" id="oval:ssg-var_password_hashing_algorithm:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for opensc smartcard drivers" datatype="string" id="oval:ssg-var_smartcard_drivers:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</oval-def:literal_component>
            <oval-def:literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</oval-def:literal_component>
            <oval-def:literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth" version="1">
          <oval-def:concat>
            <oval-def:literal_component>\nauth[\s]+required[\s]+pam_env.so</oval-def:literal_component>
            <oval-def:literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</oval-def:literal_component>
            <oval-def:literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n.*</oval-def:literal_component>
            <oval-def:literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_uids:var:1" datatype="int" version="1" comment="Count of all uids (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_uids:var:1" datatype="int" version="1" comment="Count of unique uids">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="user_id" object_ref="oval:ssg-obj_all_uids:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_authorized_local_users_regex:var:1" version="1" datatype="string" comment="accounts authorized local users on operating system"/>
        <oval-def:external_variable comment="inactive days expiration" datatype="int" id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
          <oval-def:count>
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" datatype="int" version="1" comment="Count of unique username rows retrieved from /etc/passwd">
          <oval-def:count>
            <oval-def:unique>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_etc_passwd_content:obj:1"/>
            </oval-def:unique>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Maximum password age" datatype="int" id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Minimum password age in days" datatype="int" id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Password minimum length" datatype="int" id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable comment="password expiration warning age in days" datatype="int" id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_password_auth_default_hashing_rounds:var:1" datatype="int" version="1" comment="Default number of password hashing rounds">
          <oval-def:literal_component>5000</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:external_variable comment="number of passwords hashing rounds" datatype="int" id="oval:ssg-var_password_pam_unix_rounds:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_system_auth_default_hashing_rounds:var:1" datatype="int" version="1" comment="Default number of password hashing rounds">
          <oval-def:literal_component>5000</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" comment="GIDs from /etc/group" datatype="string" version="1">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_uid_min_value:var:1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs" version="1">
          <oval-def:regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
          </oval-def:regex_capture>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_accounts_fail_delay:var:1" datatype="int" version="1" comment="Expected fail_delay"/>
        <oval-def:external_variable comment="maximum number of concurrent logins per user" datatype="int" id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for TMOUT" datatype="int" id="oval:ssg-var_accounts_tmout:var:1" version="1"/>
        <oval-def:local_variable comment="Split the PATH on the : delimiter" datatype="string" id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1">
          <oval-def:split delimiter=":">
            <oval-def:object_component item_field="value" object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1"/>
          </oval-def:split>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" comment="First octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" comment="Second octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" comment="Third octal digit of umask from /etc/login.defs" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" comment="/etc/login.defs umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" comment="First octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" comment="Second octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" comment="Third octal digit of umask from /etc/profile" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" comment="/etc/profile umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_all_privileged_commands:var:1" comment="All privileged commands" datatype="string" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1" comment="count of suid / sgid binaries actually present on the system" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" comment="count of suid / sgid binaries having full audit rule definition in some of /etc/audit/rules.d/*.rules files" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" item_field="subexpression"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" comment="count of suid / sgid binaries having full audit rule definition in /etc/audit/audit.rules file" datatype="int" version="1">
          <oval-def:count>
            <oval-def:object_component object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" item_field="subexpression"/>
          </oval-def:count>
        </oval-def:local_variable>
        <oval-def:external_variable comment="audispd remote_server setting" datatype="string" id="oval:ssg-var_audispd_remote_server:var:1" version="1"/>
        <oval-def:external_variable comment="audit disk_error_action setting" datatype="string" id="oval:ssg-var_auditd_disk_error_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit disk_full_action setting" datatype="string" id="oval:ssg-var_auditd_disk_full_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit action_mail_acct setting" datatype="string" id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1"/>
        <oval-def:external_variable comment="audit admin_space_left_action setting" datatype="string" id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit flush setting" datatype="string" id="oval:ssg-var_auditd_flush:var:1" version="1"/>
        <oval-def:external_variable comment="audit max_log_file setting" datatype="int" id="oval:ssg-var_auditd_max_log_file:var:1" version="1"/>
        <oval-def:external_variable comment="audit max_log_file_action setting" datatype="string" id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1"/>
        <oval-def:external_variable comment="audit num_logs setting" datatype="int" id="oval:ssg-var_auditd_num_logs:var:1" version="1"/>
        <oval-def:external_variable comment="audit space_left_action setting" datatype="string" id="oval:ssg-var_auditd_space_left_action:var:1" version="2"/>
        <oval-def:external_variable comment="audit space_left setting" datatype="int" id="oval:ssg-var_auditd_space_left_percentage:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfg_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfg_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfo_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfo_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" datatype="string" version="1" comment="$IncludeConfig value converted to regex">
          <oval-def:unique>
            <oval-def:glob_to_regex>
              <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1"/>
            </oval-def:glob_to_regex>
          </oval-def:unique>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_syslog_config:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:literal_component datatype="string">^/etc/rsyslog.conf$</oval-def:literal_component>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_all_log_files:var:1" datatype="string" version="1" comment="Locations of all rsyslog configuration files as collection">
          <oval-def:object_component object_ref="oval:ssg-object_var_rfp_all_log_files:obj:1" item_field="value"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" datatype="string" version="1" comment="File paths of all rsyslog configuration files">
          <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-object_rfp_log_files_paths:obj:1"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="used for remediation only" datatype="string" id="oval:ssg-rsyslog_remote_loghost_address:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" datatype="string" version="1" comment="all files with sgid set that come from a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" datatype="string" version="1" comment="all files with sgid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" datatype="string" version="1" comment="all files with suid set that come from a RPM package">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" datatype="string" version="1" comment="all files with suid set">
          <oval-def:object_component item_field="filepath" object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" datatype="int" version="1" comment="all GIDs on the target system">
          <oval-def:object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" comment="List of valid user ids" datatype="int" version="1">
          <oval-def:object_component item_field="user_id" object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable comment="Source device of /var/tmp" datatype="string" id="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" version="1">
          <oval-def:object_component item_field="device" object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" comment="First octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" comment="Second octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" comment="Third octal digit of umask from /etc/init.d/functions" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:object_component item_field="subexpression" object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" comment="/etc/init.d/functions umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_dev_device_files:var:1" comment="all device files within /dev directory" datatype="string" version="1">
          <oval-def:object_component object_ref="oval:ssg-object_dev_device_files:obj:1" item_field="filepath"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="External variable: name of selinux policy in /etc/selinux/config" datatype="string" id="oval:ssg-var_selinux_policy_name:var:1" version="1"/>
        <oval-def:external_variable comment="external variable for selinux state" datatype="string" id="oval:ssg-var_selinux_state:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_db_modified_time:var:1" datatype="string" version="1" comment="When the 'local' dconf DB has been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_db:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" datatype="int" version="1" comment="When dconf keyfiles in the 'local' tree have been modified">
          <oval-def:time_difference format_2="seconds_since_epoch">
            <oval-def:object_component object_ref="oval:ssg-obj_dconf_local_config:obj:1" item_field="m_time"/>
          </oval-def:time_difference>
        </oval-def:local_variable>
        <oval-def:external_variable comment="inactivity timeout variable" datatype="int" id="oval:ssg-inactivity_timeout_value:var:1" version="1"/>
        <oval-def:external_variable comment="screensaver lock delay variable" datatype="int" id="oval:ssg-var_screensaver_lock_delay:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" version="1" comment="Age of /etc/crypto-policies/state/current" datatype="int">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_current_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1" version="1" comment="Age of /etc/crypto-policies/config" datatype="int">
          <oval-def:object_component object_ref="oval:ssg-crypto_policies_config_file:obj:1" item_field="m_time"/>
        </oval-def:local_variable>
        <oval-def:external_variable comment="defined crypto policy" datatype="string" id="oval:ssg-var_system_crypto_policy:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy" version="1">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy" version="1">
          <oval-def:object_component item_field="canonical_path" object_ref="oval:ssg-object_kerberos_crypto_policy_backend:obj:1"/>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-sshd_ciphers_crypto:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>Ciphers </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_ciphers:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="SSH Approved Ciphers by FIPS" datatype="string" id="oval:ssg-sshd_approved_ciphers:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-sshd_macs_crypto:var:1" datatype="string" comment="The regex of the directive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>MACs </oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="SSH Approved MACs by FIPS" datatype="string" id="oval:ssg-sshd_approved_macs:var:1" version="1"/>
        <oval-def:local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
          <oval-def:concat>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
            <oval-def:literal_component>/</oval-def:literal_component>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" datatype="string" comment="Absolute path of Aide build database file" version="1">
          <oval-def:concat>
            <oval-def:object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
            <oval-def:literal_component>/</oval-def:literal_component>
            <oval-def:object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="External variable for pam_dcredit" datatype="int" id="oval:ssg-var_password_pam_dcredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_dictcheck" datatype="int" id="oval:ssg-var_password_pam_dictcheck:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_difok" datatype="int" id="oval:ssg-var_password_pam_difok:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_lcredit" datatype="int" id="oval:ssg-var_password_pam_lcredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_maxclassrepeat" datatype="int" id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_maxrepeat" datatype="int" id="oval:ssg-var_password_pam_maxrepeat:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_minclass" datatype="int" id="oval:ssg-var_password_pam_minclass:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_minlen" datatype="int" id="oval:ssg-var_password_pam_minlen:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_ocredit" datatype="int" id="oval:ssg-var_password_pam_ocredit:var:1" version="3"/>
        <oval-def:external_variable comment="External variable for pam_ucredit" datatype="int" id="oval:ssg-var_password_pam_ucredit:var:1" version="3"/>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_chmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_chown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchmodat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fchownat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_fsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_ftruncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_lsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_open_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_openat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_CREAT EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>(?:[^.]|\.\s)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_audit_rule_openat_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
          <oval-def:concat>
            <oval-def:literal_component>^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$\n(^(?!</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>|</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>).*$\n)*^</oval-def:literal_component>
            <oval-def:object_component item_field="text" object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1"/>
            <oval-def:literal_component>$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_removexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_rename_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_renameat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_setxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_truncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_unlink_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
          <oval-def:value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-var_arufm_unlinkat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
          <oval-def:value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EPERM EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EACCES syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EACCES)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EPERM syscall">
          <oval-def:concat>
            <oval-def:variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
            <oval-def:literal_component>(?:-F\s+exit=-EPERM)</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="removable partition" datatype="string" id="oval:ssg-var_removable_partition:var:1" version="1"/>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive" version="1">
          <oval-def:concat>
            <oval-def:literal_component>^[\s]*</oval-def:literal_component>
            <oval-def:variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
            <oval-def:literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</oval-def:literal_component>
          </oval-def:concat>
        </oval-def:local_variable>
        <oval-def:external_variable comment="Variable value for sudo logfile " datatype="string" id="oval:ssg-var_sudo_logfile:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.all.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.all.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.all.log_martians" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.all.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.all.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.default.accept_source_route" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.default.log_martians" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.default.rp_filter" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.conf.default.secure_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses" datatype="int" id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv4.tcp_syncookies" datatype="int" id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.accept_ra_defrtr" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.accept_ra_pinfo" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.accept_ra_rtr_pref" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.autoconf" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.max_addresses" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.all.router_solicitations" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.accept_ra" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.accept_ra_defrtr" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.accept_ra_pinfo" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.accept_ra_rtr_pref" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.accept_redirects" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.autoconf" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.max_addresses" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" version="1"/>
        <oval-def:external_variable comment="External variable for net.ipv6.conf.default.router_solicitations" datatype="int" id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" version="1"/>
        <oval-def:constant_variable id="oval:ssg-var_pam_pwquality_config_path:var:1" version="1" datatype="string" comment="correct path for pam_pwquality.so check">
          <oval-def:value>/etc/pam.d/system-auth</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" datatype="string" comment="CD/DVD drive alternative names whitelist" version="1">
          <oval-def:value>/dev/cdrom</oval-def:value>
          <oval-def:value>/dev/dvd</oval-def:value>
          <oval-def:value>/dev/scd0</oval-def:value>
          <oval-def:value>/dev/sr0</oval-def:value>
        </oval-def:constant_variable>
        <oval-def:external_variable comment="May be defined by Profiles to explicitly say if sshd is required or not" datatype="int" id="oval:ssg-sshd_required:var:1" version="1"/>
        <oval-def:external_variable id="oval:ssg-var_accounts_user_umask:var:1" datatype="string" version="1" comment="Value of var_accounts_user_umask (the required umask) as string"/>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" comment="First octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Second octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" comment="Third octal digit of umask from var_accounts_user_umask" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" comment="var_accounts_user_umask umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
        <oval-def:external_variable id="oval:ssg-var_umask_for_daemons:var:1" datatype="string" version="1" comment="Value of var_umask_for_daemons (the required umask) as string"/>
        <oval-def:local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" comment="First octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="1" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Second octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="2" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" comment="Third octal digit of umask from var_umask_for_daemons" datatype="int" version="1">
          <oval-def:substring substring_start="3" substring_length="1">
            <oval-def:variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
          </oval-def:substring>
        </oval-def:local_variable>
        <oval-def:local_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" comment="var_umask_for_daemons umask converted from string to a number" datatype="int" version="1">
          <oval-def:arithmetic arithmetic_operation="add">
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">64</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1"/>
            </oval-def:arithmetic>
            <oval-def:arithmetic arithmetic_operation="multiply">
              <oval-def:literal_component datatype="int">8</oval-def:literal_component>
              <oval-def:variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1"/>
            </oval-def:arithmetic>
            <oval-def:variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1"/>
          </oval-def:arithmetic>
        </oval-def:local_variable>
      </oval-def:variables>
    </oval-def:oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-ocil.xml" timestamp="2021-09-30T00:00:00">
    <ocil:ocil>
      <ocil:generator>
        <ocil:product_name>xccdf-create-ocil.xslt from SCAP Security Guide</ocil:product_name>
        <ocil:product_version>ssg: 0.1.58</ocil:product_version>
        <ocil:schema_version>2.0</ocil:schema_version>
        <ocil:timestamp>2021-09-30T00:00:00Z</ocil:timestamp>
      </ocil:generator>
      <ocil:questionnaires>
        <ocil:questionnaire id="ocil:ssg-prefer_64bit_os_ocil:questionnaire:1">
          <ocil:title>Prefer to use a 64-bit Operating System when supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-prefer_64bit_os_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1">
          <ocil:title>Verify File Hashes with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_hashes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1">
          <ocil:title>Verify and Correct File Permissions with RPM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rpm_verify_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_aide_installed_ocil:questionnaire:1">
          <ocil:title>Install AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_aide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_build_database_ocil:questionnaire:1">
          <ocil:title>Build and Test AIDE Database</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_build_database_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_check_audit_tools_ocil:questionnaire:1">
          <ocil:title>Configure AIDE to Verify the Audit Tools</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_check_audit_tools_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1">
          <ocil:title>Configure Periodic Execution of AIDE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-aide_periodic_cron_checking_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dracut_fips_module_ocil:questionnaire:1">
          <ocil:title>Enable Dracut FIPS Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dracut_fips_module_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_fips_mode_ocil:questionnaire:1">
          <ocil:title>Enable FIPS Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_fips_mode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-etc_system_fips_exists_ocil:questionnaire:1">
          <ocil:title>Ensure '/etc/system-fips' exists</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-etc_system_fips_exists_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_crypto_fips_enabled_ocil:questionnaire:1">
          <ocil:title>Set kernel parameter 'crypto.fips_enabled' to 1</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure BIND to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_bind_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure System Cryptography Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_gnutls_tls_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure GnuTLS library to use DoD-approved TLS Encryption</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_gnutls_tls_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Kerberos to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure Libreswan to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure OpenSSL library to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_openssl_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH to use System Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_ssh_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_ssh_client_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Harden SSH client Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Harden SSHD Crypto Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_ocil:questionnaire:1">
          <ocil:title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-installed_OS_is_FIPS_certified_ocil:questionnaire:1">
          <ocil:title>The Installed Operating System Is FIPS 140-2 Certified</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-installed_OS_is_vendor_supported_ocil:questionnaire:1">
          <ocil:title>The Installed Operating System Is Vendor Supported</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_user_data_backups_ocil:questionnaire:1">
          <ocil:title>Configure Backups of User Data</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_user_data_backups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_antivirus_ocil:questionnaire:1">
          <ocil:title>Install Virus Scanning Software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_antivirus_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_hids_ocil:questionnaire:1">
          <ocil:title>Install Intrusion Detection Software</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_hids_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_MFEhiplsm_installed_ocil:questionnaire:1">
          <ocil:title>Install the Host Intrusion Prevention System (HIPS) Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_MFEhiplsm_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_boot_ocil:questionnaire:1">
          <ocil:title>Ensure /boot Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_boot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
          <ocil:title>Ensure /home Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_opt_ocil:questionnaire:1">
          <ocil:title>Ensure /opt Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_opt_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_srv_ocil:questionnaire:1">
          <ocil:title>Ensure /srv Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_srv_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
          <ocil:title>Ensure /tmp Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_usr_ocil:questionnaire:1">
          <ocil:title>Ensure /usr Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_usr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
          <ocil:title>Ensure /var Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Ensure /var/log/audit Located On Separate Partition</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gdm_removed_ocil:questionnaire:1">
          <ocil:title>Remove the GDM Package Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gdm_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1">
          <ocil:title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_db_up_to_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1">
          <ocil:title>Configure GNOME3 DConf User Profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_dconf_user_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login Restart and Shutdown Buttons</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1">
          <ocil:title>Disable the GNOME3 Login User List</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_enable_smartcard_auth_ocil:questionnaire:1">
          <ocil:title>Enable the GNOME3 Login Smartcard Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_ocil:questionnaire:1">
          <ocil:title>Enable the GNOME3 Screen Locking On Smartcard Removal</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_login_retries_ocil:questionnaire:1">
          <ocil:title>Set the GNOME3 Login Number of Failures</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_login_retries_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1">
          <ocil:title>Disable GDM Automatic Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1">
          <ocil:title>Disable GDM Guest Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gnome_gdm_disable_xdmcp_ocil:questionnaire:1">
          <ocil:title>Disable XDMCP in GDM</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automounting</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_automount_open_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount Opening</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_autorun_ocil:questionnaire:1">
          <ocil:title>Disable GNOME3 Automount running</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_thumbnailers_ocil:questionnaire:1">
          <ocil:title>Disable All GNOME3 Thumbnailers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_create_ocil:questionnaire:1">
          <ocil:title>Disable WIFI Network Connection Creation in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_notification_ocil:questionnaire:1">
          <ocil:title>Disable WIFI Network Notification in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1">
          <ocil:title>Require Credential Prompting for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1">
          <ocil:title>Require Encryption for Remote Access in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Idle Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Inactivity Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1">
          <ocil:title>Set GNOME3 Screensaver Lock Delay After Activation Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Screensaver Lock After Idle Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_locked_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_locked_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1">
          <ocil:title>Implement Blank Screensaver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_info_ocil:questionnaire:1">
          <ocil:title>Disable Full User Name on Splash Shield</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Screensaver Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_session_idle_user_locks_ocil:questionnaire:1">
          <ocil:title>Ensure Users Cannot Change GNOME3 Session Idle Settings</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_geolocation_ocil:questionnaire:1">
          <ocil:title>Disable Geolocation in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_power_settings_ocil:questionnaire:1">
          <ocil:title>Disable Power Settings in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_disable_user_admin_ocil:questionnaire:1">
          <ocil:title>Disable User Administration in GNOME3</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sudo_installed_ocil:questionnaire:1">
          <ocil:title>Install sudo Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sudo_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_noexec_ocil:questionnaire:1">
          <ocil:title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_requiretty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_add_use_pty_ocil:questionnaire:1">
          <ocil:title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_add_use_pty_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_custom_logfile_ocil:questionnaire:1">
          <ocil:title>Ensure Sudo Logfile Exists - sudo logfile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_custom_logfile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_no_authenticate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_remove_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_require_authentication_ocil:questionnaire:1">
          <ocil:title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_require_authentication_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudo_vdsm_nopasswd_ocil:questionnaire:1">
          <ocil:title>Only the VDSM User Can Use sudo NOPASSWD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_explicit_command_args_ocil:questionnaire:1">
          <ocil:title>Explicit arguments in sudo specifications</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_explicit_command_args_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_command_negation_ocil:questionnaire:1">
          <ocil:title>Don't define allowed commands in sudoers by means of exclusion</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_command_negation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_no_root_target_ocil:questionnaire:1">
          <ocil:title>Don't target root user in the sudoers file</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_no_root_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sudoers_validate_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure invoking users password for privilege escalation when using sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sudoers_validate_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_binutils_installed_ocil:questionnaire:1">
          <ocil:title>Install binutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_binutils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_cryptsetup-luks_installed_ocil:questionnaire:1">
          <ocil:title>Install cryptsetup-luks Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gnutls-utils_installed_ocil:questionnaire:1">
          <ocil:title>Ensure gnutls-utils is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gnutls-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libcap-ng-utils_installed_ocil:questionnaire:1">
          <ocil:title>Install libcap-ng-utils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nss-tools_installed_ocil:questionnaire:1">
          <ocil:title>Ensure nss-tools is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nss-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openscap-scanner_installed_ocil:questionnaire:1">
          <ocil:title>Install openscap-scanner Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openscap-scanner_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rear_installed_ocil:questionnaire:1">
          <ocil:title>Install rear Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rear_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rng-tools_installed_ocil:questionnaire:1">
          <ocil:title>Install rng-tools Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rng-tools_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_scap-security-guide_installed_ocil:questionnaire:1">
          <ocil:title>Install scap-security-guide Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_scap-security-guide_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tar_installed_ocil:questionnaire:1">
          <ocil:title>Install tar Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tar_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_vim_installed_ocil:questionnaire:1">
          <ocil:title>Install vim Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_vim_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-addon-ccpp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-addon-ccpp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-addon-kerneloops_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-addon-kerneloops Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-addon-python_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-addon-python Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-addon-python_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-cli_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-cli Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-cli_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-logger_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-logger Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-rhtsupport Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt-plugin-sosreport_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall abrt-plugin-sosreport Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_geolite2-city_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall geolite2-city Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_geolite2-city_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_geolite2-country_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall geolite2-country Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_geolite2-country_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_gssproxy_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall gssproxy Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_gssproxy_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_iprutils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall iprutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_iprutils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_krb5-workstation_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall krb5-workstation Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_krb5-workstation_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tuned_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall tuned Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tuned_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_dnf-automatic_installed_ocil:questionnaire:1">
          <ocil:title>Install dnf-automatic Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_dnf-automatic_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_apply_updates_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Available Updates Automatically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_apply_updates_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dnf-automatic_security_updates_only_ocil:questionnaire:1">
          <ocil:title>Configure dnf-automatic to Install Only Security Updates</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_fedora_gpgkey_installed_ocil:questionnaire:1">
          <ocil:title>Ensure Fedora GPG Key Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_fedora_gpgkey_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled In Main dnf Configuration</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for Local Packages</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure gpgcheck Enabled for All dnf Package Repositories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-timer_dnf-automatic_enabled_ocil:questionnaire:1">
          <ocil:title>Enable dnf-automatic Timer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Modify the System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-banner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Modify the System Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-banner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership of System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify Group Ownership of Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify ownership of System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify ownership of Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_issue_ocil:questionnaire:1">
          <ocil:title>Verify permissions on System Login Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_issue_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_motd_ocil:questionnaire:1">
          <ocil:title>Verify permissions on Message of the Day Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_motd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1">
          <ocil:title>Enable GNOME3 Login Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1">
          <ocil:title>Set the GNOME3 Login Warning Banner Text</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-display_login_attempts_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Displays Last Logon/Access Notification</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-display_login_attempts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-enable_pam_namespace_ocil:questionnaire:1">
          <ocil:title>Set Up a Private Namespace in PAM Configuration</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-enable_pam_namespace_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse: system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1">
          <ocil:title>Limit Password Reuse</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1">
          <ocil:title>Set Deny For Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1">
          <ocil:title>Configure the root Account for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_ocil:questionnaire:1">
          <ocil:title>Enforce pam_faillock for Local Accounts Only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_enforce_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1">
          <ocil:title>Set Interval For Counting Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1">
          <ocil:title>Set Lockout Time for Failed Password Attempts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_dictcheck_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_difok_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_enforce_local_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_enforce_local_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_enforce_root_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Enforce for root User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_lcredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Consecutive Repeating Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minclass_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Length</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_minlen_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ocredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_retry_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1">
          <ocil:title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/libuser.conf</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1">
          <ocil:title>Set Password Hashing Algorithm in /etc/login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1">
          <ocil:title>Set PAM's Password Hashing Algorithm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1">
          <ocil:title>Disable debug-shell SystemD Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_debug-shell_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1">
          <ocil:title>Disable Ctrl-Alt-Del Reboot Activation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_disable_interactive_boot_ocil:questionnaire:1">
          <ocil:title>Verify that Interactive Boot is Disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_disable_interactive_boot_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_emergency_target_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Emergency Systemd Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_emergency_target_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1">
          <ocil:title>Require Authentication for Single User Mode</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-require_singleuser_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_screen_installed_ocil:questionnaire:1">
          <ocil:title>Install the screen Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_screen_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_tmux_installed_ocil:questionnaire:1">
          <ocil:title>Install the tmux Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_tmux_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_bashrc_exec_tmux_ocil:questionnaire:1">
          <ocil:title>Support session locking with tmux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_bashrc_exec_tmux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_tmux_lock_after_time_ocil:questionnaire:1">
          <ocil:title>Configure tmux to lock session after inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_tmux_lock_after_time_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_tmux_lock_command_ocil:questionnaire:1">
          <ocil:title>Configure the tmux Lock Command</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_tmux_lock_command_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_tmux_in_shells_ocil:questionnaire:1">
          <ocil:title>Prevent user from disabling the screen lock</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_tmux_in_shells_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_opensc_installed_ocil:questionnaire:1">
          <ocil:title>Install the opensc Package For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_opensc_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1">
          <ocil:title>Install the pcsc-lite package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_pcsc-lite_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-install_smartcard_packages_ocil:questionnaire:1">
          <ocil:title>Install Smart Card Packages For Multifactor Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-install_smartcard_packages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the pcscd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_pcscd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1">
          <ocil:title>Configure opensc Smart Card Drivers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_opensc_card_drivers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_opensc_nss_db_ocil:questionnaire:1">
          <ocil:title>Configure NSS DB To Use opensc</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_opensc_nss_db_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-force_opensc_card_drivers_ocil:questionnaire:1">
          <ocil:title>Force opensc To Use Defined Smart Card Driver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-force_opensc_card_drivers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-smartcard_auth_ocil:questionnaire:1">
          <ocil:title>Enable Smart Card Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-smartcard_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_id_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique User IDs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_id_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_authorized_local_users_ocil:questionnaire:1">
          <ocil:title>Only Authorized Local User Accounts Exist on Operating System</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_authorized_local_users_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1">
          <ocil:title>Set Account Expiration Following Inactivity</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_disable_post_pw_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_emergency_expire_date_ocil:questionnaire:1">
          <ocil:title>Assign Expiration Date to Emergency Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_emergency_expire_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1">
          <ocil:title>Assign Expiration Date to Temporary Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_temp_expire_date_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_unique_name_ocil:questionnaire:1">
          <ocil:title>Ensure All Accounts on the System Have Unique Names</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_unique_name_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-account_use_centralized_automated_auth_ocil:questionnaire:1">
          <ocil:title>Use Centralized and Automated Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-account_use_centralized_automated_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Maximum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Minimum Length in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1">
          <ocil:title>Set Password Warning Age</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_all_shadowed_sha512_ocil:questionnaire:1">
          <ocil:title>Verify All Account Password Hashes are Shadowed with SHA512</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - password-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_ocil:questionnaire:1">
          <ocil:title>Set number of Password Hashing Rounds - system-auth</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1">
          <ocil:title>All GIDs referenced in /etc/passwd must be defined in /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-gid_passwd_group_same_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Prevent Login to Accounts With Empty Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_group_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_legacy_plus_entries_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Ensure there are no legacy + NIS entries in /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_legacy_plus_entries_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_netrc_files_ocil:questionnaire:1">
          <ocil:title>Verify No netrc Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_netrc_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1">
          <ocil:title>Verify Only Root Has UID 0</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_no_uid_except_zero_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1">
          <ocil:title>Direct root Logins Not Allowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_direct_root_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_password_auth_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Are Locked</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1">
          <ocil:title>Restrict Web Browser Use for Administrative Accounts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_root_webbrowsing_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1">
          <ocil:title>Ensure that System Accounts Do Not Run a Shell Upon Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1">
          <ocil:title>Restrict Serial Port Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-restrict_serial_port_logins_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-root_path_default_ocil:questionnaire:1">
          <ocil:title>Root Path Must Be Vendor Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-root_path_default_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1">
          <ocil:title>Restrict Virtual Console Root Logins</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-securetty_root_login_console_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-use_pam_wheel_for_su_ocil:questionnaire:1">
          <ocil:title>Enforce usage of pam_wheel for su authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-use_pam_wheel_for_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_have_homedir_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure Home Directories are Created for New Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1">
          <ocil:title>Ensure the Logon Failure Delay is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_logon_fail_delay_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1">
          <ocil:title>Limit the Number of Concurrent Login Sessions Allowed Per User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_polyinstantiated_var_tmp_ocil:questionnaire:1">
          <ocil:title>Configure Polyinstantiation of /var/tmp Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_tmout_ocil:questionnaire:1">
          <ocil:title>Set Interactive Session Timeout</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_tmout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1">
          <ocil:title>Ensure that User Home Directories are not Group-Writable or World-Readable</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_home_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1">
          <ocil:title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in login.defs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1">
          <ocil:title>Ensure the Default Umask is Set Correctly in /etc/profile</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-accounts_umask_etc_profile_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1">
          <ocil:title>Install audispd-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audispd-plugins_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audit-audispd-plugins_installed_ocil:questionnaire:1">
          <ocil:title>Ensure the default plugins for the audit dispatcher are Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audit-audispd-plugins_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_audit_installed_ocil:questionnaire:1">
          <ocil:title>Ensure the audit Subsystem is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_audit_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable auditd Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1">
          <ocil:title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_audit_backlog_limit_argument_ocil:questionnaire:1">
          <ocil:title>Extend Audit Backlog Limit for the Audit Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_group_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_group_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_gshadow_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_gshadow_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_passwd_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_passwd_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_open_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_etc_shadow_openat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_etc_shadow_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Mandatory Access Controls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_mac_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Exporting to Media (successful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_media_export_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Network Environment</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects System Administrator Actions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/gshadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/security/opasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify User/Group Information - /etc/shadow</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_access_var_log_audit_ocil:questionnaire:1">
          <ocil:title>Record Access Events to Audit Log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_access_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-directory_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0750 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-directory_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Be Owned By Root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1">
          <ocil:title>System Audit Logs Must Have Mode 0640 or Less Permissive</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_audit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_dac_modification_umount2_ocil:questionnaire:1">
          <ocil:title>Record Events that Modify the System's Discretionary Access Controls - umount2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_chcon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run chcon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_chcon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_restorecon_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run restorecon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_restorecon_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_semanage_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run semanage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_semanage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_setsebool_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run setsebool</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_setsebool_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_execution_seunshare_ocil:questionnaire:1">
          <ocil:title>Record Any Attempts to Run seunshare</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_execution_seunshare_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - rmdir</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects File Deletion Events by User - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - creat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - ftruncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Successful Ownership Changes to Files - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - open</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - open_by_handle_at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - open O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - openat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - openat O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_rename_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_renameat_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Successful Permission Changes to Files - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_truncate_ocil:questionnaire:1">
          <ocil:title>Record Successful Access Attempts to Files - truncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlink_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_ocil:questionnaire:1">
          <ocil:title>Record Successful Delete Attempts to Files - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - chmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - creat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fchmod</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fchmodat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - fchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - fchownat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - fsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - ftruncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Ownership Changes to Files - lchown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - lremovexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - lsetxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - openat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - removexattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - rename</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - renameat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Permission Changes to Files - setxattr</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessful Access Attempts to Files - truncate</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - unlink</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_ocil:questionnaire:1">
          <ocil:title>Record Unsuccessul Delete Attempts to Files - unlinkat</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on Kernel Module Loading - init_module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_faillock_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - faillock</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_faillock_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - lastlog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_login_events_tallylog_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Logon and Logout Events - tallylog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_at_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - at</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chage_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_chsh_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_crontab_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_gpasswd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_mount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newgrp_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_newuidmap_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_passwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_pt_chown_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_pt_chown_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_su_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - su</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudo_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_sudoedit_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_umount_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_userhelper_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_privileged_commands_usernetctl_ocil:questionnaire:1">
          <ocil:title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through adjtimex</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_adjtimex_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through clock_settime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_clock_settime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1">
          <ocil:title>Record attempts to alter time through settimeofday</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_settimeofday_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter Time Through stime</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_stime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1">
          <ocil:title>Record Attempts to Alter the localtime File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_configure_remote_server_ocil:questionnaire:1">
          <ocil:title>Configure audispd Plugin To Send Logs To Remote Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_configure_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_encrypt_sent_records_ocil:questionnaire:1">
          <ocil:title>Encrypt Audit Records Sent With audispd Plugin</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_encrypt_sent_records_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1">
          <ocil:title>Configure auditd to use audispd's syslog plugin</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_error_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Error Action on Disk Error</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_error_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_disk_full_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd Disk Full Action when Disk Space Is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_disk_full_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1">
          <ocil:title>Configure auditd mail_acct Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd admin_space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1">
          <ocil:title>Configure auditd flush priority</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_flush_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1">
          <ocil:title>Configure auditd Max Log File Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1">
          <ocil:title>Configure auditd Number of Logs Retained</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_num_logs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left Action on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_data_retention_space_left_percentage_ocil:questionnaire:1">
          <ocil:title>Configure auditd space_left on Low Disk Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_freq_ocil:questionnaire:1">
          <ocil:title>Set number of records to cause an explicit flush to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_freq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_local_events_ocil:questionnaire:1">
          <ocil:title>Include Local Events in Audit Logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_local_events_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_log_format_ocil:questionnaire:1">
          <ocil:title>Resolve information before writing to audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_log_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_name_format_ocil:questionnaire:1">
          <ocil:title>Set hostname as computer node name in audit logs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_name_format_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_overflow_action_ocil:questionnaire:1">
          <ocil:title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_overflow_action_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-auditd_write_logs_ocil:questionnaire:1">
          <ocil:title>Write Audit Logs to the Disk</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-auditd_write_logs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_pti_argument_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Page-Table Isolation (KPTI)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_pti_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_vsyscall_argument_ocil:questionnaire:1">
          <ocil:title>Disable vsyscalls</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_vsyscall_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify /boot/grub2/grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_admin_username_ocil:questionnaire:1">
          <ocil:title>Set the Boot Loader Admin Username to a Non-Default Value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_admin_username_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_password_ocil:questionnaire:1">
          <ocil:title>Set Boot Loader Password in grub2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg User Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_efi_grub2_cfg_ocil:questionnaire:1">
          <ocil:title>Verify the UEFI Boot Loader grub.cfg Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_uefi_admin_username_ocil:questionnaire:1">
          <ocil:title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_uefi_admin_username_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_uefi_password_ocil:questionnaire:1">
          <ocil:title>Set the UEFI Boot Loader Password</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_uefi_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog-gnutls_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog-gnutls is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
          <ocil:title>Enable rsyslog Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1">
          <ocil:title>Ensure cron Is Logging To Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_cron_logging_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_ocil:questionnaire:1">
          <ocil:title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
          <ocil:title>Ensure Log Files Are Owned By Appropriate User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
          <ocil:title>Ensure System Log Files Have Correct Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_access_monitoring_ocil:questionnaire:1">
          <ocil:title>Ensure remote access methods are monitored in Rsyslog</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
          <ocil:title>Ensure Logrotate Runs Periodically</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1">
          <ocil:title>Ensure syslog-ng is Installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_syslogng_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_syslogng_enabled_ocil:questionnaire:1">
          <ocil:title>Enable syslog-ng Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_syslogng_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_nolisten_ocil:questionnaire:1">
          <ocil:title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_nolisten_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
          <ocil:title>Ensure Logs Sent To Remote Host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_ocil:questionnaire:1">
          <ocil:title>Configure TLS for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-rsyslog_remote_tls_cacert_ocil:questionnaire:1">
          <ocil:title>Configure CA certificate for rsyslog remote logging</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_nmcli_permissions_ocil:questionnaire:1">
          <ocil:title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_nmcli_permissions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure System is Not Acting as a Network Sniffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-network_sniffer_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1">
          <ocil:title>Verify firewalld Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_firewalld_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1">
          <ocil:title>Set Default firewalld Zone for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_firewalld_default_zone_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1">
          <ocil:title>Install libreswan Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libreswan_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1">
          <ocil:title>Verify Any Configured IPSec Tunnel Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-libreswan_approved_tunnels_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_iptables_installed_ocil:questionnaire:1">
          <ocil:title>Install iptables Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_iptables_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ip6tables_enabled_ocil:questionnaire:1">
          <ocil:title>Verify ip6tables Enabled if Using IPv6</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ip6tables_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1">
          <ocil:title>Verify iptables Enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_ip6tables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default ip6tables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_ip6tables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Incoming Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-set_iptables_default_rule_forward_ocil:questionnaire:1">
          <ocil:title>Set Default iptables Policy for Forwarded Packets</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-set_iptables_default_rule_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_ipv6_disable_argument_ocil:questionnaire:1">
          <ocil:title>Ensure IPv6 is disabled through kernel boot parameter</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_ipv6_option_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Networking Support Automatic Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_ocil:questionnaire:1">
          <ocil:title>Disable IPv6 Addressing on IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1">
          <ocil:title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_ocil:questionnaire:1">
          <ocil:title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_ocil:questionnaire:1">
          <ocil:title>Configure Auto Configuration on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_ocil:questionnaire:1">
          <ocil:title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_ocil:questionnaire:1">
          <ocil:title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1">
          <ocil:title>Configure Kernel Parameter for Accepting Secure Redirects By Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_ocil:questionnaire:1">
          <ocil:title>Set Kernel Parameter to Increase Local Port Range</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_atm_disabled_ocil:questionnaire:1">
          <ocil:title>Disable ATM Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_atm_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_can_disabled_ocil:questionnaire:1">
          <ocil:title>Disable CAN Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_can_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1">
          <ocil:title>Disable DCCP Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_dccp_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_firewire-core_disabled_ocil:questionnaire:1">
          <ocil:title>Disable IEEE 1394 (FireWire) Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_rds_disabled_ocil:questionnaire:1">
          <ocil:title>Disable RDS Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_rds_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1">
          <ocil:title>Disable TIPC Support</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_tipc_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Bluetooth Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_bluetooth_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Bluetooth Kernel Module</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-wireless_disable_interfaces_ocil:questionnaire:1">
          <ocil:title>Deactivate Wireless Network Interfaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-wireless_disable_interfaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_root_owned_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Owned by root user</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1">
          <ocil:title>Verify that All World-Writable Directories Have Sticky Bits Set</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Owned by a System Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_group_ocil:questionnaire:1">
          <ocil:title>Ensure All World-Writable Directories Are Group Owned by a System Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_systemmap_ocil:questionnaire:1">
          <ocil:title>Verify that local System.map file (if exists) is readable only by root</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_systemmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1">
          <ocil:title>Ensure All SGID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1">
          <ocil:title>Ensure All SUID Executables Are Authorized</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1">
          <ocil:title>Ensure No World-Writable Files Exist</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_ungroupowned_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1">
          <ocil:title>Ensure All Files Are Owned by a User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_files_unowned_by_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_hardlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Hardlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_protected_symlinks_ocil:questionnaire:1">
          <ocil:title>Enable Kernel Parameter to Enforce DAC on Symlinks</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_backup_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on Backup shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on group File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on gshadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on passwd File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on shadow File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupowner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Group Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupowner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_owner_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify User Who Owns /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_owner_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log Directory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_var_log_messages_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on /var/log/messages File</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_var_log_messages_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_group_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Group Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-dir_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Directories Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-dir_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_groupownership_system_commands_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that system commands files are group owned by root </ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Root Ownership</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_ownership_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that System Executables Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_binary_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1">
          <ocil:title>Verify that Shared Library Files Have Restrictive Permissions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_library_dirs_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-root_permissions_syslibrary_files_ocil:questionnaire:1">
          <ocil:title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are owned by root.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-root_permissions_syslibrary_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable the Automounter</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_autofs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_cramfs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Mounting of cramfs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Modprobe Loading of USB Storage Driver</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_noauto_ocil:questionnaire:1">
          <ocil:title>Add noauto Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_noauto_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_boot_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /boot</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_boot_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_dev_shm_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /dev/shm</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_home_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /home</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_home_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to Non-Root Local Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to Removable Media Partitions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_opt_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /opt</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_opt_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_srv_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /srv</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_srv_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /tmp</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_audit_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log/audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_log_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var/log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_log_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nodev_ocil:questionnaire:1">
          <ocil:title>Add nodev Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nodev_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_noexec_ocil:questionnaire:1">
          <ocil:title>Add noexec Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_noexec_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-mount_option_var_nosuid_ocil:questionnaire:1">
          <ocil:title>Add nosuid Option to /var</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-mount_option_var_nosuid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_core_pattern_ocil:questionnaire:1">
          <ocil:title>Disable storing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Access to Kernel Message Buffer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kexec_load_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Kernel Image Loading</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_modules_disabled_ocil:questionnaire:1">
          <ocil:title>Disable loading and unloading of kernel modules</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_ocil:questionnaire:1">
          <ocil:title>Limit CPU consumption of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_ocil:questionnaire:1">
          <ocil:title>Limit sampling frequency of the Perf system</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_perf_event_paranoid_ocil:questionnaire:1">
          <ocil:title>Disallow kernel profiling by unprivileged users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_pid_max_ocil:questionnaire:1">
          <ocil:title>Configure maximum number of process identifiers</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_pid_max_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_sysrq_ocil:questionnaire:1">
          <ocil:title>Disallow magic SysRq key</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_sysrq_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Access to Network bpf() Syscall From Unprivileged Processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_ocil:questionnaire:1">
          <ocil:title>Restrict usage of ptrace to descendant processes</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_net_core_bpf_jit_harden_ocil:questionnaire:1">
          <ocil:title>Harden the operation of the BPF just-in-time compiler</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_user_max_user_namespaces_ocil:questionnaire:1">
          <ocil:title>Disable the use of user namespaces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_vm_mmap_min_addr_ocil:questionnaire:1">
          <ocil:title>Prevent applications from mapping low portion of virtual memory</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_systemd-coredump_disabled_ocil:questionnaire:1">
          <ocil:title>Disable acquiring, saving, and processing core dumps</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_systemd-coredump_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_backtraces_ocil:questionnaire:1">
          <ocil:title>Disable core dump backtraces</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_backtraces_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coredump_disable_storage_ocil:questionnaire:1">
          <ocil:title>Disable storing core dump</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coredump_disable_storage_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for All Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_users_coredumps_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
          <ocil:title>Disable Core Dumps for SUID programs</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-umask_for_daemons_ocil:questionnaire:1">
          <ocil:title>Set Daemon Umask</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-umask_for_daemons_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1">
          <ocil:title>Enable ExecShield via sysctl</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_kptr_restrict_ocil:questionnaire:1">
          <ocil:title>Restrict Exposed Kernel Pointer Addresses Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
          <ocil:title>Enable Randomized Layout of Virtual Address Space</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_page_poison_argument_ocil:questionnaire:1">
          <ocil:title>Enable page allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_page_poison_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_slub_debug_argument_ocil:questionnaire:1">
          <ocil:title>Enable SLUB/SLAB allocator poisoning</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_slub_debug_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1">
          <ocil:title>Install libselinux Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_libselinux_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_policycoreutils_installed_ocil:questionnaire:1">
          <ocil:title>Install policycoreutils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_policycoreutils_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-plugins_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-plugins Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_setroubleshoot-server_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall setroubleshoot-server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-coreos_enable_selinux_kernel_argument_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux Not Disabled in the kernel arguments</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-coreos_enable_selinux_kernel_argument_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-grub2_enable_selinux_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux Not Disabled in /etc/default/grub</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-grub2_enable_selinux_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1">
          <ocil:title>Ensure No Device Files are Unlabeled by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_confinement_of_daemons_ocil:questionnaire:1">
          <ocil:title>Ensure No Daemons are Unconfined by SELinux</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_confinement_of_daemons_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_policytype_ocil:questionnaire:1">
          <ocil:title>Configure SELinux Policy</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_policytype_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-selinux_state_ocil:questionnaire:1">
          <ocil:title>Ensure SELinux State is Enforcing</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-selinux_state_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_abrt_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall Automatic Bug Reporting Tool (abrt)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_abrt_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_cron_enabled_ocil:questionnaire:1">
          <ocil:title>Enable cron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_cron_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_crond_enabled_ocil:questionnaire:1">
          <ocil:title>Enable cron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_crond_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_atd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable At Service (atd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_atd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_anacron_ocil:questionnaire:1">
          <ocil:title>Disable anacron Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_anacron_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_bind_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall bind Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_bind_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_fapolicyd_installed_ocil:questionnaire:1">
          <ocil:title>Install fapolicyd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_fapolicyd_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall vsftpd Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_vsftpd_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1">
          <ocil:title>Enable Logging of All FTP Transactions</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ftp_log_transactions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ftp_present_banner_ocil:questionnaire:1">
          <ocil:title>Create Warning Banners for All FTP Users</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ftp_present_banner_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-kerberos_disable_no_keytab_ocil:questionnaire:1">
          <ocil:title>Disable Kerberos by removing host keytab</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-kerberos_disable_no_keytab_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openldap-clients_removed_ocil:questionnaire:1">
          <ocil:title>Ensure LDAP client is not installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openldap-clients_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall Sendmail Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sendmail_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_mail_alias_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail For The Root Account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-postfix_client_configure_relayhost_ocil:questionnaire:1">
          <ocil:title>Configure System to Forward All Mail through a specific host</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-postfix_client_configure_relayhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_nfs-utils_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall nfs-utils Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_nfs-utils_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Network File System (nfs)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_nfs_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1">
          <ocil:title>Disable Secure RPC Server Service (rpcsvcgssd)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1">
          <ocil:title>Specify UID and GID for Anonymous NFS Connections</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-nfs_no_anonymous_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_all_squash_exports_ocil:questionnaire:1">
          <ocil:title>Ensure All-Squashing Disabled On All Exports</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_all_squash_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1">
          <ocil:title>Ensure Insecure File Locking is Not Allowed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_insecure_locks_exports_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_chrony_installed_ocil:questionnaire:1">
          <ocil:title>The Chrony package is installed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_chrony_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_chronyd_enabled_ocil:questionnaire:1">
          <ocil:title>The Chronyd service is enabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_chronyd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ntp_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ntp_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_ntpd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the NTP Daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_ntpd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_client_only_ocil:questionnaire:1">
          <ocil:title>Disable chrony daemon from acting as server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_client_only_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_no_chronyc_network_ocil:questionnaire:1">
          <ocil:title>Disable network management of chrony daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_no_chronyc_network_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_ocil:questionnaire:1">
          <ocil:title>Configure Time Service Maxpoll Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>Specify a Remote NTP Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_run_as_chrony_user_ocil:questionnaire:1">
          <ocil:title>Ensure that chronyd is running under chrony user account</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-chronyd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>A remote time server for Chrony is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-chronyd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_configure_restrictions_ocil:questionnaire:1">
          <ocil:title>Configure server restrictions for ntpd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_configure_restrictions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_run_as_ntp_user_ocil:questionnaire:1">
          <ocil:title>Configure ntpd To Run As ntp User</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_run_as_ntp_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-ntpd_specify_remote_server_ocil:questionnaire:1">
          <ocil:title>Specify a Remote NTP Server</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-ntpd_specify_remote_server_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1">
          <ocil:title>Ensure rsyncd service is diabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rsyncd_disabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1">
          <ocil:title>Remove Rsh Trust Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_rngd_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the Hardware RNG Entropy Gatherer Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_rngd_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1">
          <ocil:title>Uninstall net-snmp Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_net-snmp_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_no_rwusers_ocil:questionnaire:1">
          <ocil:title>Ensure SNMP Read Write is disabled</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_no_rwusers_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1">
          <ocil:title>Ensure Default SNMP Password Is Not Used</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_not_default_password_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1">
          <ocil:title>Configure SNMP Service to Use Only SNMPv3 or Newer</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-snmpd_use_newer_protocol_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1">
          <ocil:title>Install the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_openssh-server_removed_ocil:questionnaire:1">
          <ocil:title>Remove the OpenSSH Server Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_openssh-server_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Private *_key Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_private_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1">
          <ocil:title>Verify Permissions on SSH Server Public *.pub Key Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-disable_host_auth_ocil:questionnaire:1">
          <ocil:title>Disable Host-Based Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-disable_host_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
          <ocil:title>Allow Only SSH Protocol 2</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1">
          <ocil:title>Disable Compression Or Set Compression to delayed</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_compression_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
          <ocil:title>Disable SSH Access via Empty Passwords</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Disable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1">
          <ocil:title>Disable Kerberos Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_pubkey_auth_ocil:questionnaire:1">
          <ocil:title>Disable PubkeyAuthentication Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for .rhosts Files</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for Rhosts RSA Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH Root Login</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_root_password_login_ocil:questionnaire:1">
          <ocil:title>Disable SSH root Login with a Password (Insecure)</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_root_password_login_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_tcp_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable SSH TCP Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1">
          <ocil:title>Disable SSH Support for User Known Hosts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_disable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Disable X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1">
          <ocil:title>Do Not Allow SSH Environment Options</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_gssapi_auth_ocil:questionnaire:1">
          <ocil:title>Enable GSSAPI Authentication</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1">
          <ocil:title>Enable Use of Strict Mode Checking</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_strictmodes_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1">
          <ocil:title>Enable SSH Warning Banner</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_warning_banner_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_enable_x11_forwarding_ocil:questionnaire:1">
          <ocil:title>Enable Encrypted X11 Forwarding</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_limit_user_access_ocil:questionnaire:1">
          <ocil:title>Limit Users' SSH Access</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_limit_user_access_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1">
          <ocil:title>Enable SSH Print Last Log</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_print_last_log_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_rekey_limit_ocil:questionnaire:1">
          <ocil:title>Force frequent session key renegotiation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_rekey_limit_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
          <ocil:title>Set SSH Idle Timeout Interval</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_keepalive_0_ocil:questionnaire:1">
          <ocil:title>Set SSH Client Alive Count Max to zero</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_keepalive_0_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_info_ocil:questionnaire:1">
          <ocil:title>Set LogLevel to INFO</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_info_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_loglevel_verbose_ocil:questionnaire:1">
          <ocil:title>Set SSH Daemon LogLevel to VERBOSE</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_auth_tries_ocil:questionnaire:1">
          <ocil:title>Set SSH authentication attempt limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_auth_tries_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_max_sessions_ocil:questionnaire:1">
          <ocil:title>Set SSH MaxSessions limit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_max_sessions_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_set_maxstartups_ocil:questionnaire:1">
          <ocil:title>Ensure SSH MaxStartups is configured</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_set_maxstartups_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_directory_configuration_ocil:questionnaire:1">
          <ocil:title>Distribute the SSH Server configuration to multiple files in a config directory.</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_directory_configuration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1">
          <ocil:title>Enable Use of Privilege Separation</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_use_priv_separation_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sshd_x11_use_localhost_ocil:questionnaire:1">
          <ocil:title>Prevent remote hosts from connecting to the proxy display</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sshd_x11_use_localhost_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_sssd-ipa_installed_ocil:questionnaire:1">
          <ocil:title>Install sssd-ipa Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_sssd-ipa_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_certificate_verification_ocil:questionnaire:1">
          <ocil:title>Certificate certificate status checking in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_certificate_verification_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_certmap_ocil:questionnaire:1">
          <ocil:title>Enable Certmap in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_certmap_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1">
          <ocil:title>Enable Smartcards in SSSD</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_enable_smartcards_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1">
          <ocil:title>Configure SSSD's Memory Cache to Expire</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_memcache_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to Expire Offline Credentials</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_offline_cred_expiration_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_run_as_sssd_user_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to run as user sssd</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_run_as_sssd_user_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1">
          <ocil:title>Configure SSSD to Expire SSH Known Hosts</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_usbguard_installed_ocil:questionnaire:1">
          <ocil:title>Install usbguard Package</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_usbguard_installed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-service_usbguard_enabled_ocil:questionnaire:1">
          <ocil:title>Enable the USBGuard Service</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-service_usbguard_enabled_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-configure_usbguard_auditbackend_ocil:questionnaire:1">
          <ocil:title>Log USBGuard daemon audit events using Linux Audit</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-configure_usbguard_auditbackend_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hid_ocil:questionnaire:1">
          <ocil:title>Authorize Human Interface Devices in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hid_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hid_and_hub_ocil:questionnaire:1">
          <ocil:title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-usbguard_allow_hub_ocil:questionnaire:1">
          <ocil:title>Authorize USB hubs in USBGuard daemon</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-usbguard_allow_hub_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1">
          <ocil:title>Remove the X Windows Package Group</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
        <ocil:questionnaire id="ocil:ssg-xwindows_runlevel_target_ocil:questionnaire:1">
          <ocil:title>Disable X Windows Startup By Setting Default Target</ocil:title>
          <ocil:actions>
            <ocil:test_action_ref>ocil:ssg-xwindows_runlevel_target_action:testaction:1</ocil:test_action_ref>
          </ocil:actions>
        </ocil:questionnaire>
      </ocil:questionnaires>
      <ocil:test_actions>
        <ocil:boolean_question_test_action id="ocil:ssg-prefer_64bit_os_action:testaction:1" question_ref="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_hashes_action:testaction:1" question_ref="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rpm_verify_permissions_action:testaction:1" question_ref="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_aide_installed_action:testaction:1" question_ref="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_build_database_action:testaction:1" question_ref="ocil:ssg-aide_build_database_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_check_audit_tools_action:testaction:1" question_ref="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-aide_periodic_cron_checking_action:testaction:1" question_ref="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dracut_fips_module_action:testaction:1" question_ref="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_fips_mode_action:testaction:1" question_ref="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-etc_system_fips_exists_action:testaction:1" question_ref="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_crypto_fips_enabled_action:testaction:1" question_ref="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_bind_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_gnutls_tls_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_gnutls_tls_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_kerberos_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_libreswan_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_openssl_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_ssh_crypto_policy_action:testaction:1" question_ref="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_ssh_client_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_action:testaction:1" question_ref="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-installed_OS_is_vendor_supported_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_user_data_backups_action:testaction:1" question_ref="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_antivirus_action:testaction:1" question_ref="ocil:ssg-install_antivirus_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_hids_action:testaction:1" question_ref="ocil:ssg-install_hids_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_MFEhiplsm_installed_action:testaction:1" question_ref="ocil:ssg-package_MFEhiplsm_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_boot_action:testaction:1" question_ref="ocil:ssg-partition_for_boot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_opt_action:testaction:1" question_ref="ocil:ssg-partition_for_opt_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_srv_action:testaction:1" question_ref="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_usr_action:testaction:1" question_ref="ocil:ssg-partition_for_usr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gdm_removed_action:testaction:1" question_ref="ocil:ssg-package_gdm_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_db_up_to_date_action:testaction:1" question_ref="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_dconf_user_profile_action:testaction:1" question_ref="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_login_retries_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_retries_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_xdmcp_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_open_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_autorun_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_locked_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_locked_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_session_idle_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sudo_installed_action:testaction:1" question_ref="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_noexec_action:testaction:1" question_ref="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_requiretty_action:testaction:1" question_ref="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_add_use_pty_action:testaction:1" question_ref="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_custom_logfile_action:testaction:1" question_ref="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_no_authenticate_action:testaction:1" question_ref="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_remove_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_require_authentication_action:testaction:1" question_ref="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudo_vdsm_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_explicit_command_args_action:testaction:1" question_ref="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_command_negation_action:testaction:1" question_ref="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_no_root_target_action:testaction:1" question_ref="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sudoers_validate_passwd_action:testaction:1" question_ref="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_binutils_installed_action:testaction:1" question_ref="ocil:ssg-package_binutils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1" question_ref="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gnutls-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libcap-ng-utils_installed_action:testaction:1" question_ref="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nss-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openscap-scanner_installed_action:testaction:1" question_ref="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rear_installed_action:testaction:1" question_ref="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rng-tools_installed_action:testaction:1" question_ref="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_scap-security-guide_installed_action:testaction:1" question_ref="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tar_installed_action:testaction:1" question_ref="ocil:ssg-package_tar_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_vim_installed_action:testaction:1" question_ref="ocil:ssg-package_vim_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-addon-ccpp_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-addon-kerneloops_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-addon-python_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-addon-python_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-cli_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-cli_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-logger_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt-plugin-sosreport_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_geolite2-city_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-city_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_geolite2-country_removed_action:testaction:1" question_ref="ocil:ssg-package_geolite2-country_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_gssproxy_removed_action:testaction:1" question_ref="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_iprutils_removed_action:testaction:1" question_ref="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_krb5-workstation_removed_action:testaction:1" question_ref="ocil:ssg-package_krb5-workstation_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tuned_removed_action:testaction:1" question_ref="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_dnf-automatic_installed_action:testaction:1" question_ref="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_apply_updates_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dnf-automatic_security_updates_only_action:testaction:1" question_ref="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_fedora_gpgkey_installed_action:testaction:1" question_ref="ocil:ssg-ensure_fedora_gpgkey_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-timer_dnf-automatic_enabled_action:testaction:1" question_ref="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_issue_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-banner_etc_motd_action:testaction:1" question_ref="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_issue_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_issue_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_motd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_motd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-display_login_attempts_action:testaction:1" question_ref="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-enable_pam_namespace_action:testaction:1" question_ref="ocil:ssg-enable_pam_namespace_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_dictcheck_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_difok_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_enforce_local_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_enforce_local_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_enforce_root_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_lcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minclass_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_minlen_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ocredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_retry_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_ucredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_debug-shell_disabled_action:testaction:1" question_ref="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_disable_interactive_boot_action:testaction:1" question_ref="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_emergency_target_auth_action:testaction:1" question_ref="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-require_singleuser_auth_action:testaction:1" question_ref="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_screen_installed_action:testaction:1" question_ref="ocil:ssg-package_screen_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_tmux_installed_action:testaction:1" question_ref="ocil:ssg-package_tmux_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_bashrc_exec_tmux_action:testaction:1" question_ref="ocil:ssg-configure_bashrc_exec_tmux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_tmux_lock_after_time_action:testaction:1" question_ref="ocil:ssg-configure_tmux_lock_after_time_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_tmux_lock_command_action:testaction:1" question_ref="ocil:ssg-configure_tmux_lock_command_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_tmux_in_shells_action:testaction:1" question_ref="ocil:ssg-no_tmux_in_shells_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_opensc_installed_action:testaction:1" question_ref="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_pcsc-lite_installed_action:testaction:1" question_ref="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-install_smartcard_packages_action:testaction:1" question_ref="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_pcscd_enabled_action:testaction:1" question_ref="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_opensc_card_drivers_action:testaction:1" question_ref="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_opensc_nss_db_action:testaction:1" question_ref="ocil:ssg-configure_opensc_nss_db_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-force_opensc_card_drivers_action:testaction:1" question_ref="ocil:ssg-force_opensc_card_drivers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-smartcard_auth_action:testaction:1" question_ref="ocil:ssg-smartcard_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_id_action:testaction:1" question_ref="ocil:ssg-account_unique_id_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_authorized_local_users_action:testaction:1" question_ref="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_disable_post_pw_expiration_action:testaction:1" question_ref="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_emergency_expire_date_action:testaction:1" question_ref="ocil:ssg-account_emergency_expire_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_temp_expire_date_action:testaction:1" question_ref="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_unique_name_action:testaction:1" question_ref="ocil:ssg-account_unique_name_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-account_use_centralized_automated_auth_action:testaction:1" question_ref="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_sha512_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-gid_passwd_group_same_action:testaction:1" question_ref="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_empty_passwords_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_group_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_passwd_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_legacy_plus_entries_etc_shadow_action:testaction:1" question_ref="ocil:ssg-no_legacy_plus_entries_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_netrc_files_action:testaction:1" question_ref="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_no_uid_except_zero_action:testaction:1" question_ref="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_direct_root_logins_action:testaction:1" question_ref="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_root_webbrowsing_action:testaction:1" question_ref="ocil:ssg-no_root_webbrowsing_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-restrict_serial_port_logins_action:testaction:1" question_ref="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-root_path_default_action:testaction:1" question_ref="ocil:ssg-root_path_default_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-securetty_root_login_console_only_action:testaction:1" question_ref="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-use_pam_wheel_for_su_action:testaction:1" question_ref="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_have_homedir_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_logon_fail_delay_action:testaction:1" question_ref="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1" question_ref="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1" question_ref="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_tmout_action:testaction:1" question_ref="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_home_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1" question_ref="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-accounts_umask_etc_profile_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audit-audispd-plugins_installed_action:testaction:1" question_ref="ocil:ssg-package_audit-audispd-plugins_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_audit_installed_action:testaction:1" question_ref="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_audit_backlog_limit_argument_action:testaction:1" question_ref="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_group_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_group_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_gshadow_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_gshadow_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_passwd_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_passwd_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_etc_shadow_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_etc_shadow_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_media_export_action:testaction:1" question_ref="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1" question_ref="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_group_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_gshadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_opasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_shadow_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_access_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-directory_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_umount2_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_chcon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_restorecon_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_semanage_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_setsebool_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_execution_seunshare_action:testaction:1" question_ref="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_rmdir_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_finit_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_init_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_faillock_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_login_events_tallylog_action:testaction:1" question_ref="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_at_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chage_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_chsh_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_crontab_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_gpasswd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_mount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newgrp_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_newuidmap_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_passwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_pt_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_pt_chown_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_su_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudo_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_sudoedit_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_umount_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_userhelper_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_usernetctl_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_adjtimex_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_clock_settime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_settimeofday_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_stime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_configure_remote_server_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_configure_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_encrypt_sent_records_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_encrypt_sent_records_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_error_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_disk_full_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_flush_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_num_logs_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_percentage_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_freq_action:testaction:1" question_ref="ocil:ssg-auditd_freq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_local_events_action:testaction:1" question_ref="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_log_format_action:testaction:1" question_ref="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_name_format_action:testaction:1" question_ref="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_overflow_action_action:testaction:1" question_ref="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-auditd_write_logs_action:testaction:1" question_ref="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_pti_argument_action:testaction:1" question_ref="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_vsyscall_argument_action:testaction:1" question_ref="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_admin_username_action:testaction:1" question_ref="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_password_action:testaction:1" question_ref="ocil:ssg-grub2_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_efi_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_uefi_admin_username_action:testaction:1" question_ref="ocil:ssg-grub2_uefi_admin_username_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_uefi_password_action:testaction:1" question_ref="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog-gnutls_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_cron_logging_action:testaction:1" question_ref="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_action:testaction:1" question_ref="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_syslogng_installed_action:testaction:1" question_ref="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_syslogng_enabled_action:testaction:1" question_ref="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_nolisten_action:testaction:1" question_ref="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-rsyslog_remote_tls_cacert_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_nmcli_permissions_action:testaction:1" question_ref="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-network_sniffer_disabled_action:testaction:1" question_ref="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_firewalld_enabled_action:testaction:1" question_ref="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_firewalld_default_zone_action:testaction:1" question_ref="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libreswan_installed_action:testaction:1" question_ref="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-libreswan_approved_tunnels_action:testaction:1" question_ref="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_iptables_installed_action:testaction:1" question_ref="ocil:ssg-package_iptables_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ip6tables_enabled_action:testaction:1" question_ref="ocil:ssg-service_ip6tables_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_iptables_enabled_action:testaction:1" question_ref="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_ip6tables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-set_iptables_default_rule_forward_action:testaction:1" question_ref="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1" question_ref="ocil:ssg-grub2_ipv6_disable_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_ipv6_option_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_atm_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_can_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_dccp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_firewire-core_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_rds_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_tipc_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-service_bluetooth_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-wireless_disable_interfaces_action:testaction:1" question_ref="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_root_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_group_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_systemmap_action:testaction:1" question_ref="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_ungroupowned_action:testaction:1" question_ref="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_files_unowned_by_user_action:testaction:1" question_ref="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_hardlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_protected_symlinks_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_backup_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupowner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_owner_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_var_log_messages_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_group_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-dir_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_groupownership_system_commands_dirs_action:testaction:1" question_ref="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-root_permissions_syslibrary_files_action:testaction:1" question_ref="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_autofs_disabled_action:testaction:1" question_ref="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_cramfs_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_noauto_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_noauto_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_boot_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_home_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_opt_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_srv_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_tmp_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_audit_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_log_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nodev_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_noexec_action:testaction:1" question_ref="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-mount_option_var_nosuid_action:testaction:1" question_ref="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_core_pattern_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kexec_load_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_modules_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_perf_event_paranoid_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_pid_max_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_sysrq_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_net_core_bpf_jit_harden_action:testaction:1" question_ref="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_user_max_user_namespaces_action:testaction:1" question_ref="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_vm_mmap_min_addr_action:testaction:1" question_ref="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_systemd-coredump_disabled_action:testaction:1" question_ref="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_backtraces_action:testaction:1" question_ref="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coredump_disable_storage_action:testaction:1" question_ref="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_users_coredumps_action:testaction:1" question_ref="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-umask_for_daemons_action:testaction:1" question_ref="ocil:ssg-umask_for_daemons_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_kptr_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_page_poison_argument_action:testaction:1" question_ref="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_slub_debug_argument_action:testaction:1" question_ref="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_libselinux_installed_action:testaction:1" question_ref="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_policycoreutils_installed_action:testaction:1" question_ref="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_setroubleshoot-server_removed_action:testaction:1" question_ref="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-coreos_enable_selinux_kernel_argument_action:testaction:1" question_ref="ocil:ssg-coreos_enable_selinux_kernel_argument_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-grub2_enable_selinux_action:testaction:1" question_ref="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1" question_ref="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_confinement_of_daemons_action:testaction:1" question_ref="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_policytype_action:testaction:1" question_ref="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-selinux_state_action:testaction:1" question_ref="ocil:ssg-selinux_state_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_abrt_removed_action:testaction:1" question_ref="ocil:ssg-package_abrt_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_cron_enabled_action:testaction:1" question_ref="ocil:ssg-service_cron_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_crond_enabled_action:testaction:1" question_ref="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_atd_disabled_action:testaction:1" question_ref="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_anacron_action:testaction:1" question_ref="ocil:ssg-disable_anacron_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_bind_removed_action:testaction:1" question_ref="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_fapolicyd_installed_action:testaction:1" question_ref="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_vsftpd_removed_action:testaction:1" question_ref="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ftp_log_transactions_action:testaction:1" question_ref="ocil:ssg-ftp_log_transactions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ftp_present_banner_action:testaction:1" question_ref="ocil:ssg-ftp_present_banner_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-kerberos_disable_no_keytab_action:testaction:1" question_ref="ocil:ssg-kerberos_disable_no_keytab_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openldap-clients_removed_action:testaction:1" question_ref="ocil:ssg-package_openldap-clients_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sendmail_removed_action:testaction:1" question_ref="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_mail_alias_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-postfix_client_configure_relayhost_action:testaction:1" question_ref="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_nfs-utils_removed_action:testaction:1" question_ref="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_nfs_disabled_action:testaction:1" question_ref="ocil:ssg-service_nfs_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-nfs_no_anonymous_action:testaction:1" question_ref="ocil:ssg-nfs_no_anonymous_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_all_squash_exports_action:testaction:1" question_ref="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_insecure_locks_exports_action:testaction:1" question_ref="ocil:ssg-no_insecure_locks_exports_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_chrony_installed_action:testaction:1" question_ref="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_chronyd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ntp_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntp_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_ntpd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_client_only_action:testaction:1" question_ref="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_no_chronyc_network_action:testaction:1" question_ref="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_run_as_chrony_user_action:testaction:1" question_ref="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-chronyd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_configure_restrictions_action:testaction:1" question_ref="ocil:ssg-ntpd_configure_restrictions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_run_as_ntp_user_action:testaction:1" question_ref="ocil:ssg-ntpd_run_as_ntp_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-ntpd_specify_remote_server_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rsyncd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-no_rsh_trust_files_action:testaction:1" question_ref="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_rngd_enabled_action:testaction:1" question_ref="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_net-snmp_removed_action:testaction:1" question_ref="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_no_rwusers_action:testaction:1" question_ref="ocil:ssg-snmpd_no_rwusers_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_not_default_password_action:testaction:1" question_ref="ocil:ssg-snmpd_not_default_password_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-snmpd_use_newer_protocol_action:testaction:1" question_ref="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_installed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_openssh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-disable_host_auth_action:testaction:1" question_ref="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_compression_action:testaction:1" question_ref="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_kerb_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_pubkey_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_root_password_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_disable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1" question_ref="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_strictmodes_action:testaction:1" question_ref="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_limit_user_access_action:testaction:1" question_ref="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_print_last_log_action:testaction:1" question_ref="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_rekey_limit_action:testaction:1" question_ref="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_0_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_info_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_loglevel_verbose_action:testaction:1" question_ref="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_auth_tries_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_max_sessions_action:testaction:1" question_ref="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_set_maxstartups_action:testaction:1" question_ref="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_directory_configuration_action:testaction:1" question_ref="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_use_priv_separation_action:testaction:1" question_ref="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sshd_x11_use_localhost_action:testaction:1" question_ref="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_sssd-ipa_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd-ipa_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_certificate_verification_action:testaction:1" question_ref="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_certmap_action:testaction:1" question_ref="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_enable_smartcards_action:testaction:1" question_ref="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_memcache_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_memcache_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_offline_cred_expiration_action:testaction:1" question_ref="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_run_as_sssd_user_action:testaction:1" question_ref="ocil:ssg-sssd_run_as_sssd_user_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_usbguard_installed_action:testaction:1" question_ref="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-service_usbguard_enabled_action:testaction:1" question_ref="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-configure_usbguard_auditbackend_action:testaction:1" question_ref="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hid_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hid_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hid_and_hub_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-usbguard_allow_hub_action:testaction:1" question_ref="ocil:ssg-usbguard_allow_hub_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1" question_ref="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
        <ocil:boolean_question_test_action id="ocil:ssg-xwindows_runlevel_target_action:testaction:1" question_ref="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:when_true>
            <ocil:result>PASS</ocil:result>
          </ocil:when_true>
          <ocil:when_false>
            <ocil:result>FAIL</ocil:result>
          </ocil:when_false>
        </ocil:boolean_question_test_action>
      </ocil:test_actions>
      <ocil:questions>
        <ocil:boolean_question id="ocil:ssg-prefer_64bit_os_question:question:1">
          <ocil:question_text>To check if the installed Operating System is 64-bit, run the following command:
$ uname -m
The output should be one of the following: x86_64, aarch64, ppc64le or s390x.
If the output is i686 or i386 the operating system is 32-bit.
Check if the installed CPU supports 64-bit operating systems by running the following command:
$ lscpu | grep "CPU op-mode"
If the output contains 64bit, the CPU supports 64-bit operating systems.
      Is it the case that the installed operating sytem is 32-bit but the CPU supports operation in 64-bit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_hashes_question:question:1">
          <ocil:question_text>The following command will list which files on the system
have file hashes different from what is expected by the RPM database.
$ rpm -Va --noconfig | awk '$1 ~ /..5/ &amp;&amp; $2 != "c"'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rpm_verify_permissions_question:question:1">
          <ocil:question_text>The following command will list which files on the system have permissions different from what
is expected by the RPM database:
$ rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_aide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the aide package is installed: $ rpm -q aide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_build_database_question:question:1">
          <ocil:question_text>To find the location of the AIDE databse file, run the following command:
$ sudo ls -l DBDIR/database_file_name
      Is it the case that there is no database file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_check_audit_tools_question:question:1">
          <ocil:question_text>Check that AIDE is properly configured to protect the integrity of the
audit tools by running the following command:

# sudo cat /etc/aide.conf | grep /usr/sbin/au

/usr/sbin/auditctl p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/auditd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/ausearch p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/aureport p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/autrace p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/audispd p+i+n+u+g+s+b+acl+selinux+xattrs+sha512
/usr/sbin/augenrules p+i+n+u+g+s+b+acl+selinux+xattrs+sha512

If AIDE is configured properly to protect the integrity of the audit tools,
all lines listed above will be returned from the command.

If one or more lines are missing, this is a finding.
      Is it the case that integrity checks of the audit tools are missing or incomplete?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-aide_periodic_cron_checking_question:question:1">
          <ocil:question_text>To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return something similar to the following:

05 4 * * * root  --check


NOTE: The usage of special cron times, such as @daily or @weekly, is acceptable.
      Is it the case that there is no output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dracut_fips_module_question:question:1">
          <ocil:question_text>To verify that the Dracut FIPS module is enabled, run the following command:
grep "add_dracutmodules" /etc/dracut.conf.d/40-fips.conf
The output should look like this:
add_dracutmodules+=" fips "
      Is it the case that the Dracut FIPS module is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_fips_mode_question:question:1">
          <ocil:question_text>To verify that FIPS is enabled properly, run the following command:
fips-mode-setup --check
The output should contain the following:
FIPS mode is enabled.
      Is it the case that FIPS mode is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-etc_system_fips_exists_question:question:1">
          <ocil:question_text>To verify /etc/system-fips exists, run the following command:
ls -l /etc/system-fips
The output should be similar to the the following:
-rw-r--r--. 1 root root 36 Nov 26 11:31 /etc/system-fips
      Is it the case that /etc/system-fips does not exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_crypto_fips_enabled_question:question:1">
          <ocil:question_text>To verify that kernel parameter 'crypto.fips_enabled' is set properly, run the following command:
sysctl crypto.fips_enabled
The output should contain the following:
crypto.fips_enabled =  1
      Is it the case that crypto.fips_enabled is not 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_bind_crypto_policy_question:question:1">
          <ocil:question_text>To verify that BIND uses the system crypto policy, check out that the BIND config file
/etc/named.conf contains the include "/etc/crypto-policies/back-ends/bind.config";
directive: grep 'include "/etc/crypto-policies/back-ends/bind.config";' /etc/named.conf,
and verify that the directive is at the bottom of the options section of the config file.
      Is it the case that BIND is installed and the BIND config file doesn't contain the
&lt;pre&gt;include "/etc/crypto-policies/back-ends/bind.config";&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_crypto_policy_question:question:1">
          <ocil:question_text>To verify that cryptography policy has been configured correctly, run the
following command:
$ update-crypto-policies --show
The output should return .
Run the command to check if the policy is correctly applied:
$ update-crypto-policies --is-applied
The output should be The configured policy is applied.
Moreover, check if settings for selected crypto policy are as expected.
List all libraries for which it holds that their crypto policies do not have symbolic link in /etc/crypto-policies/back-ends.
$ ls -l /etc/crypto-policies/back-ends/ | grep '^[^l]' | tail -n +2 | awk -F' ' '{print $NF}' | awk -F'.' '{print $1}' | sort
Subsequently, check if matching libraries have drop in files in the /etc/crypto-policies/local.d directory.
$ ls /etc/crypto-policies/local.d/ | awk -F'-' '{print $1}' | uniq | sort
Outputs of two previous commands should match.
      Is it the case that cryptographic policy is not configured or is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_gnutls_tls_crypto_policy_question:question:1">
          <ocil:question_text>To verify if GnuTLS uses defined DoD-approved TLS Crypto Policy, run:
$ grep
'+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0'
/etc/crypto-policies/back-ends/gnutls.config and verify that a match exists.
      Is it the case that cryptographic policy for gnutls is not configured or is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_kerberos_crypto_policy_question:question:1">
          <ocil:question_text>Check that the symlink exists and target the correct kerberos crypto policy, with the following command:
file /etc/krb5.conf.d/crypto-policies
If command ouput shows the following line, kerberos is configured to use the system-wide crypto policy.
/etc/krb5.conf.d/crypto-policies: symbolic link to /etc/crypto-policies/back-ends/krb5.config
      Is it the case that the symlink does not exist or points to a different target?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_libreswan_crypto_policy_question:question:1">
          <ocil:question_text>To verify that Libreswan uses the system crypto policy, run the following command:
$ grep include /etc/ipsec.conf
The output should return something similar to:
include /etc/crypto-policies/back-ends/libreswan.config
      Is it the case that Libreswan is installed and &lt;tt&gt;/etc/ipsec.conf&lt;/tt&gt; does not contain &lt;tt&gt;include /etc/crypto-policies/back-ends/libreswan.config&lt;/tt&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_openssl_crypto_policy_question:question:1">
          <ocil:question_text>To verify that OpenSSL uses the system crypto policy, check out that the OpenSSL config file
/etc/pki/tls/openssl.cnf contains the [ crypto_policy ] section with the
.include /etc/crypto-policies/back-ends/opensslcnf.config directive:
grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' /etc/pki/tls/openssl.cnf.
      Is it the case that the OpenSSL config file doesn't contain the whole section,
or that the section doesn't have the &lt;pre&gt;.include /etc/crypto-policies/back-ends/opensslcnf.config&lt;/pre&gt; directive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_ssh_crypto_policy_question:question:1">
          <ocil:question_text>Check that the CRYPTO_POLICY variable is not set or is commented in the
/etc/sysconfig/sshd.
      Is it the case that the CRYPTO_POLICY variable is not set or is commented in the /etc/sysconfig/sshd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_ssh_client_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH Client uses defined Crypto Policy, run:
$ cat /etc/ssh/ssh_config.d/02-ospp.conf
and verify that the line matches
Match final all
RekeyLimit 512M 1h
GSSAPIAuthentication no
Ciphers aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc
PubkeyAcceptedKeyTypes ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256
MACs hmac-sha2-512,hmac-sha2-256
KexAlgorithms ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1
      Is it the case that Crypto Policy for OpenSSH Client is not configured according to CC requirements?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined Cipher suite in the Crypto Policy, run:
$ grep -i ciphers /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
Ciphers 
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH server uses defined Crypto Policy, run:
$ grep 'CRYPTO_POLICY' /etc/crypto-policies/back-ends/opensshserver.config | tail -n 1
and verify that the line matches
CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'
      Is it the case that Crypto Policy for OpenSSH Server is not configured according to CC requirements?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-harden_sshd_macs_openssh_conf_crypto_policy_question:question:1">
          <ocil:question_text>To verify if the OpenSSH client uses defined MACs in the Crypto Policy, run:
$ grep -i macs /etc/crypto-policies/back-ends/openssh.config
and verify that the line matches:
MACs hmac-sha2-512,hmac-sha2-256
      Is it the case that Crypto Policy for OpenSSH client is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-installed_OS_is_FIPS_certified_question:question:1">
          <ocil:question_text>To verify that the installed operating system is supported or certified, run
the following command:

The output should contain something similar to:
Fedora
      Is it the case that the installed operating system is not FIPS 140-2 certified?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-installed_OS_is_vendor_supported_question:question:1">
          <ocil:question_text>To verify that the installed operating system is supported, run
the following command:

The output should contain something similar to:
Fedora
      Is it the case that the installed operating system is not supported?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_user_data_backups_question:question:1">
          <ocil:question_text>Verify that the system backups user data.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_antivirus_question:question:1">
          <ocil:question_text>Verify an anti-virus solution is installed on the system. The anti-virus solution may be
bundled with an approved host-based security solution.
      Is it the case that there is no anti-virus solution installed on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_hids_question:question:1">
          <ocil:question_text>Inspect the system to determine if intrusion detection software has been installed.
Verify this intrusion detection software is active.
      Is it the case that no host-based intrusion detection tools are installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_MFEhiplsm_installed_question:question:1">
          <ocil:question_text>To verify that McAfee HIPS is installed, run the following command(s):
$ rpm -q MFEhiplsm
      Is it the case that the HBSS HIPS module is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_boot_question:question:1">
          <ocil:question_text>Run the following command to determine if /boot
is on its own partition or logical volume:
$ mount | grep "on /boot"
If /boot has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_home_question:question:1">
          <ocil:question_text>Run the following command to determine if /home
is on its own partition or logical volume:
$ mount | grep "on /home"
If /home has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_opt_question:question:1">
          <ocil:question_text>Run the following command to determine if /opt
is on its own partition or logical volume:
$ mount | grep "on /opt"
If /opt has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_srv_question:question:1">
          <ocil:question_text>Run the following command to determine if /srv
is on its own partition or logical volume:
$ mount | grep "on /srv"
If /srv has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
          <ocil:question_text>Run the following command to determine if /tmp
is on its own partition or logical volume:
$ mount | grep "on /tmp"
If /tmp has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_usr_question:question:1">
          <ocil:question_text>Run the following command to determine if /usr
is on its own partition or logical volume:
$ mount | grep "on /usr"
If /usr has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_question:question:1">
          <ocil:question_text>Run the following command to determine if /var
is on its own partition or logical volume:
$ mount | grep "on /var"
If /var has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
          <ocil:question_text>Run the following command to determine if /var/log
is on its own partition or logical volume:
$ mount | grep "on /var/log"
If /var/log has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to determine if /var/log/audit
is on its own partition or logical volume:
$ mount | grep "on /var/log/audit"
If /var/log/audit has its own partition or volume group, a line will be returned.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gdm_removed_question:question:1">
          <ocil:question_text>To ensure the gdm package group is removed, run the following command:
$ rpm -qi gdm
The output should be:
package gdm is not installed
      Is it the case that gdm has not been removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_db_up_to_date_question:question:1">
          <ocil:question_text>In order to be sure that the databases are up-to-date, run the
dconf update
command as the administrator.
      Is it the case that The system-wide dconf databases are up-to-date with regards to respective keyfiles?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_dconf_user_profile_question:question:1">
          <ocil:question_text>To verify that the DConf User profile is configured correctly, run the following
command:

$ cat /etc/dconf/profile/user
The output should show the following:
user-db:user
system-db:local
system-db:site
system-db:distro
      Is it the case that DConf User profile does not exist or is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
          <ocil:question_text>To ensure disable and restart on the login screen are disabled, run the following command:
$ grep disable-restart-buttons /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot enable disable and restart on the login screen, run the following:
$ grep disable-restart-buttons /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-restart-buttons
      Is it the case that disable-restart-buttons has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
          <ocil:question_text>To ensure the user list is disabled, run the following command:
$ grep disable-user-list /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot enable displaying the user list, run the following:
$ grep disable-user-list /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-user-list
      Is it the case that disable-user-list has not been configured or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
          <ocil:question_text>To ensure smart card authentication on the login screen is enabled, run the following command:
$ grep enable-smartcard-authentication /etc/dconf/db/distro.d/*
The output should be true.
To ensure that users cannot disable smart card authentication on the login screen, run the following:
$ grep enable-smartcard-authentication /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/enable-smartcard-authentication
      Is it the case that enable-smartcard-authentication has not been configured or is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_lock_screen_on_smartcard_removal_question:question:1">
          <ocil:question_text>To ensure screen locking on smartcard removal is enabled, run the following command:
$ grep removal-action /etc/dconf/db/local.d/*
The output should be 'lock-screen'.
To ensure that users cannot disable screen locking on smartcard removal, run the following:
$ grep removal-action /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/settings-daemon/peripherals/smartcard/removal-action
      Is it the case that removal-action has not been configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_login_retries_question:question:1">
          <ocil:question_text>To ensure the login screen resets after a specified number of failures,
run the following command:
$ grep allowed-failures /etc/dconf/db/distro.d/*
The output should be 3 or less.
To ensure that users cannot change or configure the resets after a specified
number of failures on the login screen, run the following:
$ grep allowed-failures /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/allowed-failures
      Is it the case that allowed-failures is not equal to or less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
          <ocil:question_text>To verify that automatic logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\nautomaticlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
AutomaticLoginEnable=false
      Is it the case that GDM allows users to automatically login?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
          <ocil:question_text>To verify that timed logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\ntimedlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
TimedLoginEnable=false
      Is it the case that GDM allows a guest to login without credentials?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gnome_gdm_disable_xdmcp_question:question:1">
          <ocil:question_text>To ensure that XDMCP is disabled in /etc/gdm/custom.conf, run the following command:
grep -Pzo "\[xdmcp\]\nEnable=false" /etc/gdm/custom.conf
The output should return the following:

[xdmcp]
Enable=false

      Is it the case that the Enable is not set to false or is missing in the xdmcp section of the /etc/gdm/custom.conf gdm configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount
If properly configured, the output for automount should be false.
To ensure that users cannot enable automount in GNOME3, run the following:
$ grep 'automount' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount should be /org/gnome/desktop/media-handling/automount
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_automount_open_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount-open
If properly configured, the output for automount-openshould be false.
To ensure that users cannot enable automount opening in GNOME3, run the following:
$ grep 'automount-open' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount-open should be /org/gnome/desktop/media-handling/automount-open
      Is it the case that GNOME automounting is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_autorun_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling autorun-never
If properly configured, the output for autorun-nevershould be true.
To ensure that users cannot enable autorun in GNOME3, run the following:
$ grep 'autorun-never' /etc/dconf/db/local.d/locks/*
If properly configured, the output for autorun-never should be /org/gnome/desktop/media-handling/autorun-never
      Is it the case that GNOME autorun is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
          <ocil:question_text>These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.thumbnailers disable-all
If properly configured, the output should be true.
To ensure that users cannot how long until the the screensaver locks, run the following:
$ grep disable-all /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/thumbnailers/disable-all
      Is it the case that GNOME thumbnailers are not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
          <ocil:question_text>To ensure that WIFI connections caanot be created, run the following command:
$ gsettings get org.gnome.nm-applet disable-wifi-create
If properly configured, the output should be true.
To ensure that users cannot enable WIFI connection creation, run the following:
$ grep wifi-create /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/disable-wifi-create
      Is it the case that WIFI connections can be created through GNOME?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
          <ocil:question_text>To ensure that wireless network notification is disabled, run the following command:
$ gsettings get org.gnome.nm-applet suppress-wireless-networks-available
If properly configured, the output should be true.
To ensure that users cannot enable wireless notification, run the following:
$ grep wireless-networks-available /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/suppress-wireless-networks-available
      Is it the case that wireless network notification is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
          <ocil:question_text>To ensure that remote access requires credentials, run the following command:
$ gsettings get org.gnome.Vino authentication-methods
If properly configured, the output should be false.
To ensure that users cannot disable credentials for remote access, run the following:
$ grep authentication-methods /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/authentication-methods
      Is it the case that wireless network notification is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
          <ocil:question_text>To ensure that remote access connections are encrypted, run the following command:
$ gsettings get org.gnome.Vino require-encrpytion
If properly configured, the output should be true.
To ensure that users cannot disable encrypted remote connections, run the following:
$ grep require-encryption /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/require-encryption
      Is it the case that remote access connections are not encrypted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
          <ocil:question_text>To check the screensaver mandatory use status, run the following command:
$ gsettings get org.gnome.desktop.screensaver idle-activation-enabled
If properly configured, the output should be true.
To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled
      Is it the case that idle-activation-enabled is not enabled or configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_locked_question:question:1">
          <ocil:question_text>To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled
      Is it the case that idle-activation-enabled is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
          <ocil:question_text>To check the current idle time-out value, run the following command:
$ gsettings get org.gnome.desktop.session idle-delay
If properly configured, the output should be 'uint32 '.
To ensure that users cannot change the screensaver inactivity timeout setting, run the following:
$ grep idle-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/session/idle-delay
      Is it the case that idle-delay is not equal to or less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
          <ocil:question_text>To check that the screen locks immediately when activated, run the following command:
$ gsettings get org.gnome.desktop.screensaver lock-delay
If properly configured, the output should be 'uint32 '.

To ensure that users cannot change how long until the the screensaver locks, run the following:
$ grep lock-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-delay should be /org/gnome/desktop/screensaver/lock-delay
      Is it the case that the screensaver lock delay is missing, or is set to a value greater than 5?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
          <ocil:question_text>To check the status of the idle screen lock activation, run the following command:

$ gsettings get org.gnome.desktop.screensaver lock-enabled
If properly configured, the output should be true.
To ensure that users cannot change how long until the the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled
      Is it the case that screensaver locking is not enabled and/or has not been set or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_locked_question:question:1">
          <ocil:question_text>To ensure that users cannot change how long until the the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled
      Is it the case that screensaver locking is not locked?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
          <ocil:question_text>To ensure the screensaver is configured to be blank, run the following command:
$ gsettings get org.gnome.desktop.screensaver picture-uri
If properly configured, the output should be ''.

To ensure that users cannot set the screensaver background, run the following:
$ grep picture-uri /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/picture-uri
      Is it the case that it is not set or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
          <ocil:question_text>To ensure the splash screen is configured not to show user name, run the following command:
$ gsettings get org.gnome.desktop.screensaver show-full-name-in-top-bar
If properly configured, the output should be false.
To ensure that users cannot enable user name on the lock screen, run the following:
$ grep show-full-name-in-top-bar /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/show-full-name-in-top-bar
      Is it the case that it is not set or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'lock-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/screensaver/lock-delay
      Is it the case that GNOME3 session settings are not locked or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_session_idle_user_locks_question:question:1">
          <ocil:question_text>To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'idle-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return:
/org/gnome/desktop/session/idle-delay
      Is it the case that GNOME3 session settings are not locked or configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to ignore the Ctrl-Alt-Del sequence,
run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.media-keys logout
If properly configured, the output should be ''.
To ensure that users cannot enable the Ctrl-Alt-Del sequence, run the following:
$ grep logout /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/media-keys/logout
      Is it the case that GNOME3 is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
          <ocil:question_text>To ensure that system location tracking is not active, run the following command:
$ gsettings get org.gnome.system.location enabled
$ gsettings get org.gnome.clocks geolocation
If properly configured, the output should be false.
To ensure that users cannot enable system location tracking, run the following:
$ grep location /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/system/location/enabled and /org/gnome/clocks/geolocation.
      Is it the case that geolocation is enabled and not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
          <ocil:question_text>To ensure that the GUI power settings are not active, run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.power active
If properly configured, the output should be false.
To ensure that users cannot enable the power settings, run the following:
$ grep power /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/power/active
      Is it the case that power settings are enabled and are not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
          <ocil:question_text>To ensure the GUI does not allow user administratrion capabilities to all users,
run the following command:
$ gsettings get org.gnome.desktop.lockdown user-administration-disabled
If properly configured, the output should be true.
To ensure that users cannot enable user administration, run the following:
$ grep user-administration /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/desktop/lockdown/user-administration-disabled
      Is it the case that user administration is not configured or disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sudo_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sudo package is installed: $ rpm -q sudo
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_noexec_question:question:1">
          <ocil:question_text>To determine if NOEXEC has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\bnoexec\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that noexec is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_requiretty_question:question:1">
          <ocil:question_text>To determine if requiretty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\brequiretty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that requiretty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_add_use_pty_question:question:1">
          <ocil:question_text>To determine if use_pty has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\buse_pty\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that use_pty is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_custom_logfile_question:question:1">
          <ocil:question_text>To determine if logfile has been configured for sudo, run the following command:
$ sudo grep -ri "^[\s]*Defaults.*\blogfile\b.*" /etc/sudoers /etc/sudoers.d/
The command should return a matching output.
      Is it the case that logfile is not enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
          <ocil:question_text>To determine if !authenticate has not been configured for sudo, run the following command:
$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that !authenticate is enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_remove_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for sudo, run the following command:
$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd is enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_require_authentication_question:question:1">
          <ocil:question_text>To determine if NOPASSWD or !authenticate have been configured for
sudo, run the following command:
$ sudo grep -ri "nopasswd\|\!authenticate" /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that nopasswd and/or !authenticate is enabled in sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudo_vdsm_nopasswd_question:question:1">
          <ocil:question_text>To determine if NOPASSWD has been configured for the vdsm user for sudo,
run the following command:
$ sudo grep -ri nopasswd /etc/sudoers.d/
The command should return output only for the vdsm user.
      Is it the case that nopasswd is set for any users beyond vdsm?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_explicit_command_args_question:question:1">
          <ocil:question_text>To determine if arguments that commands can be executed with are restricted, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains user specifications that allow execution of commands with any arguments?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_command_negation_question:question:1">
          <ocil:question_text>To determine if negation is used to define commands users are allowed to execute using sudo, run the following command:
$ sudo grep -PR '^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*' /etc/sudoers /etc/sudoers.d/
The command should return no output.
      Is it the case that /etc/sudoers file contains rules that define the set of allowed commands using negation?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_no_root_target_question:question:1">
          <ocil:question_text>To determine if the users are allowed to run commands as root, run the following commands:
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]' /etc/sudoers /etc/sudoers.d/
and
$ sudo grep -PR '^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)' /etc/sudoers /etc/sudoers.d/
Both commands should return no output.
      Is it the case that /etc/sudoers file contains rules that allow non-root users to run commands as root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sudoers_validate_passwd_question:question:1">
          <ocil:question_text>Run the following command to Verify that the sudoers security policy is configured to use the invoking user's password for privilege escalation:
 sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#'
If no results are returned, this is a finding
If "Defaults !targetpw" is not defined, this is a finding.
If "Defaults !rootpw" is not defined, this is a finding.
If "Defaults !runaspw" is not defined, this is a finding.
      Is it the case that invoke user passwd when using sudo?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_binutils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the binutils package is installed: $ rpm -q binutils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_cryptsetup-luks_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the cryptsetup-luks package is installed: $ rpm -q cryptsetup-luks
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gnutls-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gnutls-utils package is installed: $ rpm -q gnutls-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libcap-ng-utils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libcap-ng-utils package is installed: $ rpm -q libcap-ng-utils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nss-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nss-tools package is installed: $ rpm -q nss-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openscap-scanner_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openscap-scanner package is installed: $ rpm -q openscap-scanner
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rear_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rear package is installed: $ rpm -q rear
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rng-tools_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rng-tools package is installed: $ rpm -q rng-tools
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_scap-security-guide_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the scap-security-guide package is installed: $ rpm -q scap-security-guide
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tar_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tar package is installed: $ rpm -q tar
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_vim_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the vim-enhanced package is installed: $ rpm -q vim-enhanced
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-addon-ccpp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-addon-ccpp package is installed:
$ rpm -q abrt-addon-ccpp
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-addon-kerneloops_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-addon-kerneloops package is installed:
$ rpm -q abrt-addon-kerneloops
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-addon-python_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-addon-python package is installed:
$ rpm -q abrt-addon-python
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-cli_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-cli package is installed:
$ rpm -q abrt-cli
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-logger_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-logger package is installed:
$ rpm -q abrt-plugin-logger
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-rhtsupport_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-rhtsupport package is installed:
$ rpm -q abrt-plugin-rhtsupport
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt-plugin-sosreport_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt-plugin-sosreport package is installed:
$ rpm -q abrt-plugin-sosreport
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_geolite2-city_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the geolite2-city package is installed:
$ rpm -q geolite2-city
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_geolite2-country_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the geolite2-country package is installed:
$ rpm -q geolite2-country
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_gssproxy_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the gssproxy package is installed:
$ rpm -q gssproxy
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_iprutils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the iprutils package is installed:
$ rpm -q iprutils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_krb5-workstation_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the krb5-workstation package is installed:
$ rpm -q krb5-workstation
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tuned_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tuned package is installed:
$ rpm -q tuned
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_dnf-automatic_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the dnf-automatic package is installed: $ rpm -q dnf-automatic
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_apply_updates_question:question:1">
          <ocil:question_text>To verify that packages comprising the available updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep apply_updates /etc/dnf/automatic.conf
The output should return the following:
apply_updates = yes
      Is it the case that apply_updates is not set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dnf-automatic_security_updates_only_question:question:1">
          <ocil:question_text>To verify that only security updates will be automatically installed by dnf-automatic, run the following command:
$ sudo grep upgrade_type /etc/dnf/automatic.conf
The output should return the following:
upgrade_type = security
      Is it the case that the upgrade_type is not set to security?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_fedora_gpgkey_installed_question:question:1">
          <ocil:question_text>To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return one of the strings below:
gpg(Fedora 34 (34) &lt;fedora-34@fedoraproject.org&gt;)
gpg(Fedora 33 (33) &lt;fedora-33@fedoraproject.org&gt;)
      Is it the case that the Fedora GPG Key is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
          <ocil:question_text>To determine whether dnf is configured to use gpgcheck,
inspect /etc/dnf/dnf.conf and ensure the following appears in the
[main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a
gpgcheck line or a setting of 0 indicates that it is
disabled.
      Is it the case that GPG checking is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
          <ocil:question_text>To verify that localpkg_gpgcheck is configured properly, run the following
command:
$ grep localpkg_gpgcheck /etc/dnf/dnf.conf
The output should return something similar to:
localpkg_gpgcheck=1
      Is it the case that gpgcheck is not enabled or configured correctly to verify local packages?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
          <ocil:question_text>To determine whether dnf has been configured to disable
gpgcheck for any repos,  inspect all files in
/etc/yum.repos.d and ensure the following does not appear in any
sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo.
      Is it the case that GPG checking is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-timer_dnf-automatic_enabled_question:question:1">
          <ocil:question_text> Run the following command to determine the current status of the dnf-automatic timer: $ systemctl is-active dnf-automatic.timer If the timer is running, it should return the following: active
      Is it the case that the dnf-automatic.timer is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_issue_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant,
run the following command:
$ cat /etc/issue
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-banner_etc_motd_question:question:1">
          <ocil:question_text>To check if the system login banner is compliant,
run the following command:
$ cat /etc/motd
      Is it the case that it does not display the required banner?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_issue_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/issue,
run the command:
$ ls -lL /etc/issue
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/issue has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_motd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/motd,
run the command:
$ ls -lL /etc/motd
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/motd has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_issue_question:question:1">
          <ocil:question_text>To check the ownership of /etc/issue,
run the command:
$ ls -lL /etc/issue
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/issue has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_motd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/motd,
run the command:
$ ls -lL /etc/motd
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/motd has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_issue_question:question:1">
          <ocil:question_text>To check the permissions of /etc/issue,
run the command:
$ ls -l /etc/issue
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/issue has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_motd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/motd,
run the command:
$ ls -l /etc/motd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/motd has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
          <ocil:question_text>To ensure a login warning banner is enabled, run the following:
$ grep banner-message-enable /etc/dconf/db/distro.d/*
If properly configured, the output should be true.
To ensure a login warning banner is locked and cannot be changed by a user, run the following:
$ grep banner-message-enable /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-enable.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
          <ocil:question_text>To ensure the login warning banner text is properly set, run the following:
$ grep banner-message-text /etc/dconf/db/distro.d/*
If properly configured, the proper banner text will appear.
To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
$ grep banner-message-text /etc/dconf/db/distro.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-text.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-display_login_attempts_question:question:1">
          <ocil:question_text>To ensure that last logon/access notification is configured correctly, run
the following command:
$ grep pam_lastlog.so /etc/pam.d/postlogin
The output should show output showfailed and must not contain
silent.
      Is it the case that that is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-enable_pam_namespace_question:question:1">
          <ocil:question_text>To check if pam_namespace.so is required for user login, run the following command:
$ grep pam_namespace.so /etc/pam.d/login
The output should return the following uncommented:
session    required     pam_namespace.so
      Is it the case that pam_namespace.so is not required or is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_password_auth_question:question:1">
          <ocil:question_text>Check that the operating system prohibits the reuse of a password for
a minimum of  generations with the following command:
# grep pam_pwhistory.so /etc/pam.d/password-auth
password  pam_pwhistory.so remember= use_authtok
If the command does not return a result, or the returned line is commented
out, has a second column value different from , does not contain
"remember" value, or the value is less than
, this is a finding.
      Is it the case that the value of remember is not set equal to or greater than &lt;sub idref="var_password_pam_remember" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_pwhistory_remember_system_auth_question:question:1">
          <ocil:question_text>Check that the operating system prohibits the reuse of a password for
a minimum of  generations with the following command:
# grep pam_pwhistory.so /etc/pam.d/system-auth
password  pam_pwhistory.so remember= use_authtok
If the command does not return a result, or the returned line is commented
out, has a second column value different from , does not contain
"remember" value, or the value is less than
, this is a finding.
      Is it the case that the value of remember is not set equal to or greater than &lt;sub idref="var_password_pam_remember" /&gt;?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
          <ocil:question_text>To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=
      Is it the case that the value of remember is not set equal to or greater than the expected setting?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show deny=.
      Is it the case that that is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
          <ocil:question_text>To ensure that even the root account is locked after a defined number of failed password
attempts, run the following command:
$ grep even_deny_root /etc/pam.d/system-auth
The output should show even_deny_root.
      Is it the case that that is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_enforce_local_question:question:1">
          <ocil:question_text>To check if root user is required to use complex passwords, run the following command:
$ grep local_users_only /etc/security/faillock.conf
The output should return local_users_only uncommented.
      Is it the case that local_users_only is not uncommented or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly,
run the following command:
$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
For each file, the output should show fail_interval=&lt;interval-in-seconds&gt; where interval-in-seconds is  or greater.
If the fail_interval parameter is not set, the default setting
of 900 seconds is acceptable.
      Is it the case that fail_interval is less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
          <ocil:question_text>To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show unlock_time=&lt;some-large-number&gt; or 0 for never.
      Is it the case that unlock_time is less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
          <ocil:question_text>To check how many digits are required in a password, run the following command:
$ grep dcredit /etc/security/pwquality.conf
The dcredit parameter (as a negative number) will indicate how many digits are required.
The DoD requires at least one digit in a password. This would appear as dcredit = -1.
      Is it the case that dcredit is not found or not equal to or less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_dictcheck_question:question:1">
          <ocil:question_text>To check if dictionary words are disallowed run the following command:
$ sudo grep dictcheck /etc/security/pwquality.conf /etc/pwquality.conf.d/*.conf
The dictcheck parameter should be equal to 1. The value should look like
dictcheck=1
      Is it the case that dictcheck is not found or not equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_difok_question:question:1">
          <ocil:question_text>To check how many characters must differ during a password change, run the following command:
$ grep difok /etc/security/pwquality.conf
The difok parameter will indicate how many characters must differ.
      Is it the case that difok is not found or not equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_enforce_local_question:question:1">
          <ocil:question_text>To verify if password complexities are only enforce on local users, run the following command:
$ grep local_users_only /etc/security/pwquality.conf
The output should return local_users_only uncommented.
      Is it the case that local_users_only is not uncommented or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_enforce_root_question:question:1">
          <ocil:question_text>To verify if root user is required to use complex passwords, run the following command:
$ grep enforce_for_root /etc/security/pwquality.conf
The output should return enforce_for_root uncommented.
      Is it the case that enforce_for_root is not uncommented or configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
          <ocil:question_text>To check how many lowercase characters are required in a password, run the following command:
$ grep lcredit /etc/security/pwquality.conf
The lcredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one lowercase character in a password. This would appear as lcredit = -1.
      Is it the case that lcredit is not found or not less than or equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
          <ocil:question_text>To check the value for maximum consecutive repeating characters, run the following command:
$ grep maxclassrepeat /etc/security/pwquality.conf
For DoD systems, the output should show maxclassrepeat=4.
      Is it the case that that is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
          <ocil:question_text>To check the maximum value for consecutive repeating characters, run the following command:
$ grep maxrepeat /etc/security/pwquality.conf
Look for the value of the maxrepeat parameter. The DoD requirement is 3, which would appear as
maxrepeat=3.
      Is it the case that maxrepeat is not found or not greater than or equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minclass_question:question:1">
          <ocil:question_text>To check how many categories of characters must be used in password during a password change,
run the following command:
$ grep minclass /etc/security/pwquality.conf
The minclass parameter will indicate how many character classes must be used. If
the requirement was for the password to contain characters from three different categories,
then this would appear as minclass = 3.
      Is it the case that minclass is not found or not set equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_minlen_question:question:1">
          <ocil:question_text>To check how many characters are required in a password, run the following command:
$ grep minlen /etc/security/pwquality.conf
Your output should contain minlen = 
      Is it the case that minlen is not found, or not equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
          <ocil:question_text>To check how many special characters are required in a password, run the following command:
$ grep ocredit /etc/security/pwquality.conf
The ocredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one special character in a password.
This would appear as ocredit = -1.
      Is it the case that ocredit is not found or not equal to or less than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_retry_question:question:1">
          <ocil:question_text>To check how many retry attempts are permitted on a per-session basis, run the following command:

$ grep pam_pwquality /etc/pam.d/system-auth 

The retry parameter will indicate how many attempts are permitted.
The DoD required value is less than or equal to 3.
This would appear as retry=3, or a lower value.
      Is it the case that it is not the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
          <ocil:question_text>To check how many uppercase characters are required in a password, run the following command:
$ grep ucredit /etc/security/pwquality.conf
The ucredit parameter (as a negative number) will indicate how many uppercase characters are required.
The DoD and FISMA require at least one uppercase character in a password.
This would appear as ucredit = -1.
      Is it the case that ucredit is not found or not set less than or equal to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
          <ocil:question_text>Inspect /etc/libuser.conf and ensure the following line appears
in the [default] section:
crypt_style = sha512
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
          <ocil:question_text>Inspect /etc/login.defs and ensure the following line appears:
ENCRYPT_METHOD SHA512
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
          <ocil:question_text>
Inspect the password section of /etc/pam.d/system-auth

and ensure that the pam_unix.so module includes the argument
sha512:

$ grep sha512 /etc/pam.d/system-auth
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_debug-shell_disabled_question:question:1">
          <ocil:question_text>
To check that the debug-shell service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled debug-shell
Output should indicate the debug-shell service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled debug-shell disabled

Run the following command to verify debug-shell is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active debug-shell

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the debug-shell is masked, run the following command:
$ systemctl show debug-shell | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
          <ocil:question_text>To ensure the system is configured to mask the Ctrl-Alt-Del sequence, Check
that the ctrl-alt-del.target is masked and not active with the following
command:
sudo systemctl status ctrl-alt-del.target
The output should indicate that the target is masked and not active. It
might resemble following output:
ctrl-alt-del.target
Loaded: masked (/dev/null; bad)
Active: inactive (dead)
      Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_disable_interactive_boot_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of
systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments.
Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates
that interactive boot is enabled at boot time.
      Is it the case that Interactive boot is enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_emergency_target_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for emergency mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/emergency.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-require_singleuser_auth_question:question:1">
          <ocil:question_text>To check if authentication is required for single-user mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/rescue.service
The output should be similar to the following, and the line must begin with
ExecStart and /usr/lib/systemd/systemd-sulogin-shell.
    ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue
      Is it the case that the output is different?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_screen_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the screen package is installed: $ rpm -q screen
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_tmux_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the tmux package is installed: $ rpm -q tmux
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_bashrc_exec_tmux_question:question:1">
          <ocil:question_text>To verify that tmux is configured to execute,
run the following command:
$ grep -A1 -B3 "case ..name. in sshd|login) exec tmux ;; esac" /etc/bashrc
The output should return the following:
if [ "$PS1" ]; then
  parent=$(ps -o ppid= -p $$)
  name=$(ps -o comm= -p $parent)
  case "$name" in sshd|login) exec tmux ;; esac
fi
      Is it the case that exec tmux is not present at the end of bashrc?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_tmux_lock_after_time_question:question:1">
          <ocil:question_text>To verify that session locking after period of inactivity is configured in tmux,
run the following command:
$ grep lock-after-time /etc/tmux.conf
The output should return the following:
set -g lock-after-time 900
      Is it the case that lock-after-time is not set or set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_tmux_lock_command_question:question:1">
          <ocil:question_text>To verify that vlock is configured as a locking mechanism in tmux, run the following command:
$ grep lock-command /etc/tmux.conf
The output should return the following:
set -g lock-command vlock
      Is it the case that lock-command is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_tmux_in_shells_question:question:1">
          <ocil:question_text>To verify that tmux is not listed as allowed shell on the system
run the following command:
$ grep 'tmux$' /etc/shells
The output should be empty.
      Is it the case that tmux is listed in /etc/shells?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_opensc_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the opensc package is installed: $ rpm -q opensc
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_pcsc-lite_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the pcsc-lite package is installed: $ rpm -q pcsc-lite
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-install_smartcard_packages_question:question:1">
          <ocil:question_text>
'Run the following command to determine if the openssl-pkcs11 package is installed:
$ rpm -q openssl-pkcs11'
      Is it the case that smartcard software is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_pcscd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
pcscd service:
$ systemctl is-active pcscd
If the service is running, it should return the following: active
      Is it the case that the pcscd service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_opensc_card_drivers_question:question:1">
          <ocil:question_text>To verify that  is configured
as the smart card driver, run the following command:
$ grep card_drivers /etc/opensc.conf
The output should return something similar to:
card_drivers = ;
      Is it the case that the smart card driver is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_opensc_nss_db_question:question:1">
          <ocil:question_text>To verify that opensc is configured in the NSS database,
run the following command:
$ pkcs11-switch
The output should return opensc
      Is it the case that opensc is not in use by the nss database?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-force_opensc_card_drivers_question:question:1">
          <ocil:question_text>To verify that  is configured
as the smart card driver, run the following command:
$ grep force_card_driver /etc/opensc.conf
The output should return something similar to:
force_card_drivers = ;
      Is it the case that the smart card driver is not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-smartcard_auth_question:question:1">
          <ocil:question_text>Interview the SA to determine if all accounts not exempted by policy are
using CAC authentication. For DoD systems, the following systems and
accounts are exempt from using smart card (CAC) authentication:
SIPRNET systemsStandalone systemsApplication accountsTemporary employee accounts, such as students or interns, who cannot
easily receive a CAC or PIVOperational tactical locations that are not collocated with RAPIDS
workstations to issue CAC or ALTTest systems, such as those with an Interim Approval to Test (IATT) and
use a separate VPN, firewall, or security measure preventing access to
network and system components from outside the protection boundary
documented in the IATT.
      Is it the case that non-exempt accounts are not using CAC authentication?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_id_question:question:1">
          <ocil:question_text>Run the following command to check for duplicate account names:
Check that the operating system contains no duplicate UIDs for interactive users by running the following command:
# awk -F ":" 'list[$3]++{print $1, $3}' /etc/passwd
If output is produced, this is a finding.
Configure the operating system to contain no duplicate UIDs for interactive users.
Edit the file "/etc/passwd" and provide each interactive user account that has a duplicate UID with a unique UID.
      Is it the case that a line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_authorized_local_users_question:question:1">
          <ocil:question_text>To verify that there are no unauthorized local user accounts, run the following command:
$ less /etc/passwd 
Inspect the results, and if unauthorized local user accounts exist, remove them by running
the following command:
$ sudo userdel unauthorized_user
      Is it the case that there are unauthorized local user accounts on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
          <ocil:question_text>To verify the INACTIVE setting, run the following command:
$ grep "INACTIVE" /etc/default/useradd
The output should indicate the INACTIVE configuration option is set
to an appropriate integer as shown in the example below:
$ grep "INACTIVE" /etc/default/useradd
INACTIVE=
      Is it the case that the value of INACTIVE is greater than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_emergency_expire_date_question:question:1">
          <ocil:question_text>For every emergency account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l ACCOUNT_NAME
Verify each of these accounts has an expiration date set as documented.
      Is it the case that any emergency accounts have no expiration date set or do not expire within a documented time frame?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_temp_expire_date_question:question:1">
          <ocil:question_text>For every temporary and emergency account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l USER
Verify each of these accounts has an expiration date set as documented.
      Is it the case that any temporary or emergency accounts have no expiration date set or do not expire within a documented time frame?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_unique_name_question:question:1">
          <ocil:question_text>To verify all accounts have unique names, run the following command:
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
No output should be returned.
      Is it the case that a line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-account_use_centralized_automated_auth_question:question:1">
          <ocil:question_text>Verify that the system is integrated with a centralized authentication mechanism
such as as Active Directory, Kerberos, Directory Server, etc. that has
automated account mechanisms in place.
      Is it the case that the system is not using a centralized authentication mechanism, or it is not automated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
          <ocil:question_text>To check the maximum password age, run the command:
$ grep PASS_MAX_DAYS /etc/login.defs
The DoD and FISMA requirement is 60.
A value of 180 days is sufficient for many environments.
      Is it the case that PASS_MAX_DAYS is not set equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
          <ocil:question_text>To check the minimum password age, run the command:
$ grep PASS_MIN_DAYS /etc/login.defs
      Is it the case that it is not equal to or greater than the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
          <ocil:question_text>To check the minimum password length, run the command:
$ grep PASS_MIN_LEN /etc/login.defs
The DoD requirement is 15.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
          <ocil:question_text>To check the password warning age, run the command:
$ grep PASS_WARN_AGE /etc/login.defs
The DoD requirement is 7.
      Is it the case that it is not set to the required value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_question:question:1">
          <ocil:question_text>To check that no password hashes are stored in
/etc/passwd, run the following command:
awk '!/\S:x|\*/ {print}' /etc/passwd
If it produces any output, then a password hash is
stored in /etc/passwd.
      Is it the case that any stored hashes are found in /etc/passwd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_all_shadowed_sha512_question:question:1">
          <ocil:question_text>Check that the interactive user account passwords are using a strong
password hash with the following command:

# sudo cut -d: -f2 /etc/shadow

$6$kcOnRq/5$NUEYPuyL.wghQwWssXRcLRFiiru7f5JPV6GaJhNC2aK5F3PZpE/BCCtwrxRc/AInKMNX3CdMw11m9STiql12f/

Password hashes ! or * indicate inactive accounts not
available for logon and are not evaluated.

If any interactive user password hash does not begin with $6,
this is a finding.
      Is it the case that passwords hashed with an unauthorized algorithm are found in /etc/shadow?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_password_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is compliant, run the following command:
$ grep rounds /etc/pam.d/password-auth
The output should show the following match:
rounds=
      Is it the case that it does not set the appropriate number of hashing rounds?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_password_pam_unix_rounds_system_auth_question:question:1">
          <ocil:question_text>To verify the number of rounds for the password hashing algorithm is compliant, run the following command:
$ grep rounds /etc/pam.d/system-auth
The output should show the following match:
rounds=
      Is it the case that it does not set the appropriate number of hashing rounds?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-gid_passwd_group_same_question:question:1">
          <ocil:question_text>To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
run the following command:
$ sudo pwck -qr
There should be no output.
      Is it the case that GIFs referenced in /etc/passwd are returned as not defined in /etc/group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_empty_passwords_question:question:1">
          <ocil:question_text>To verify that null passwords cannot be used, run the following command:

$ grep nullok /etc/pam.d/system-auth

If this produces any output, it may be possible to log into accounts
with empty passwords. Remove any instances of the nullok option to
prevent logins with empty passwords.
      Is it the case that NULL passwords can be used?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_group_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/group, run the following command:
 grep '^\+' /etc/group
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_passwd_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/passwd, run the following command:
 grep '^\+' /etc/passwd
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_legacy_plus_entries_etc_shadow_question:question:1">
          <ocil:question_text>To check for legacy lines in /etc/shadow, run the following command:
 grep '^\+' /etc/shadow
The command should not return any output.
      Is it the case that the file contains legacy lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_netrc_files_question:question:1">
          <ocil:question_text>To check the system for the existence of any .netrc files,
run the following command:
$ sudo find /home -xdev -name .netrc
      Is it the case that any .netrc files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
          <ocil:question_text>To list all password file entries for accounts with UID 0, run the
following command:
$ awk -F: '($3 == \"0\") {print}' /etc/passwd
This should print only one line, for the user root.

If there is a finding, change the UID of the failing (non-root) user. If
the account is associated with the system commands or applications the UID
should be changed to one greater than 0 but less than
1000. Otherwise assign a UID of greater than 1000 that
has not already been assigned.
      Is it the case that any account other than root has a UID of 0?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_direct_root_logins_question:question:1">
          <ocil:question_text>To ensure root may not directly login to the system over physical consoles,
run the following command:
cat /etc/securetty
If any output is returned, this is a finding.
      Is it the case that the /etc/securetty file is not empty?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_password_auth_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a listing of all users and the contents of their shadow password
field, run the command:
$ sudo awk -F: '$1 !~ /^root$/ &amp;&amp; $2 !~ /^[!*]/ {print $1 ":" $2}' /etc/shadow
Identify the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration, UID_MIN is set to 500.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_root_webbrowsing_question:question:1">
          <ocil:question_text>Check the root home directory for a .mozilla directory. If
one exists, ensure browsing is limited to local service administration.
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
          <ocil:question_text>To obtain a listing of all users, their UIDs, and their shells, run the
command: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd Identify
the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration UID_MIN is set to 1000.
      Is it the case that any system account (other than root) has a login shell?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-restrict_serial_port_logins_question:question:1">
          <ocil:question_text>To check for serial port entries which permit root login,
run the following command:
$ sudo grep ^ttyS/[0-9] /etc/securetty
If any output is returned, then root login over serial ports is permitted.
      Is it the case that root login over serial ports is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-root_path_default_question:question:1">
          <ocil:question_text>To view the root user's PATH, run the following command:
$ sudo env | grep PATH
If correctly configured, the PATH must: use vendor default settings,
have no empty entries, and have no entries beginning with a character
other than a slash (/).
      Is it the case that any of these conditions are not met?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-securetty_root_login_console_only_question:question:1">
          <ocil:question_text>To check for virtual console entries which permit root login, run the
following command:
$ sudo grep ^vc/[0-9] /etc/securetty
If any output is returned, then root logins over virtual console devices is permitted.
      Is it the case that root login over virtual console devices is permitted?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-use_pam_wheel_for_su_question:question:1">
          <ocil:question_text>Run the following command to check if the line is present:
grep pam_wheel /etc/pam.d/su
The output should contain the following line:
auth             required        pam_wheel.so use_uid
      Is it the case that the line is not in the file or it is commented?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_have_homedir_login_defs_question:question:1">
          <ocil:question_text>Check if the system is configured to create home directories for local interactive users with the following command:

$ sudo grep create_home /etc/login.defs

      Is it the case that the value of CREATE_HOME is not set to yes, is missing, or the line is commented out?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_logon_fail_delay_question:question:1">
          <ocil:question_text>Verify the FAIL_DELAY setting is configured correctly in the /etc/login.defs file by
running the following command:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
All output must show the value of FAIL_DELAY set as shown in the below:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
FAIL_DELAY 
      Is it the case that the above command returns no output, or FAIL_DELAY is configured less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
          <ocil:question_text>Run the following command to ensure the maxlogins value is
configured for all users on the system:
# grep "maxlogins" /etc/security/limits.conf
You should receive output similar to the following:
*\t\thard\tmaxlogins\t
      Is it the case that maxlogins is not equal to or less than the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /tmp is configured as a
polyinstantiated directory:
$ sudo grep /tmp /etc/security/namespace.conf
The output should return the following:
/tmp     /tmp/tmp-inst/            level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_polyinstantiated_var_tmp_question:question:1">
          <ocil:question_text>Run the following command to ensure that /var/tmp is configured as a
polyinstantiated directory:
$ sudo grep /var/tmp /etc/security/namespace.conf
The output should return the following:
/var/tmp /var/tmp/tmp-inst/    level      root,adm
      Is it the case that is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_tmout_question:question:1">
          <ocil:question_text>Run the following command to ensure the TMOUT value is configured for all users
on the system:

$ sudo grep TMOUT /etc/profile /etc/profile.d/*.sh

The output should return the following:
TMOUT=
      Is it the case that value of TMOUT is not less than or equal to expected setting?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_home_dirs_question:question:1">
          <ocil:question_text>To ensure the user home directory is not group-writable or world-readable, run the following:
# ls -ld /home/USER
      Is it the case that the user home directory is group-writable or world-readable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
          <ocil:question_text>To ensure write permissions are disabled for group and other
 for each element in root's path, run the following command:
# ls -ld DIR
      Is it the case that group or other write permissions exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
          <ocil:question_text>Verify the UMASK setting is configured correctly in the /etc/login.defs file by
running the following command:
# grep -i "UMASK" /etc/login.defs
All output must show the value of umask set as shown in the below:
# grep -i "UMASK" /etc/login.defs
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-accounts_umask_etc_profile_question:question:1">
          <ocil:question_text>Verify the umask setting is configured correctly in the /etc/profile file by
running the following command:
# grep "umask" /etc/profile
All output must show the value of umask set as shown in the below:
# grep "umask" /etc/profile
umask 
      Is it the case that the above command returns no output, or if the umask is configured incorrectly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audispd-plugins_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audispd-plugins package is installed: $ rpm -q audispd-plugins
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audit-audispd-plugins_installed_question:question:1">
          <ocil:question_text>
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_audit_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the audit package is installed: $ rpm -q audit
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
auditd service:
$ systemctl is-active auditd
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_argument_question:question:1">
          <ocil:question_text>
Inspect the form of default GRUB 2 command line for the Linux operating system
in /boot/grub2/grubenv. If they include audit=1, then auditing
is enabled at boot time.
# grep 'kernelopts.*audit=1.*' /boot/grub2/grubenv

To ensure audit=1 is configured on all installed kernels, the
following command may be used:

# grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"

      Is it the case that auditing is not enabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_audit_backlog_limit_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include audit=1, then auditing
is enabled at boot time.

To ensure audit_backlog_limit=8192 is configured on all installed kernels, the
following command may be used:

$ sudo /sbin/grubby --update-kernel=ALL --args="audit_backlog_limit=8192"

      Is it the case that audit backlog limit is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_group_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_gshadow_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_passwd_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_etc_shadow_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_mac_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/etc/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).
      Is it the case that the system is not configured to audit attempts to change the MAC policy?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_media_export_question:question:1">
          <ocil:question_text>To verify that auditing is configured for all media exportation events, run the following command:
$ sudo auditctl -l | grep syscall | grep mount
      Is it the case that there is no output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit changes to its network configuration,
run the following command:
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and perm=wa should be indicated for each).
      Is it the case that the system is not configured to audit changes of the network configuration?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/etc/sudoers\|watch=/etc/sudoers.d\|-w /etc/sudoers\|-w /etc/sudoers.d"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_group_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/group)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_gshadow_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/gshadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_opasswd_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/security/opasswd)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_passwd_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/passwd)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_usergroup_modification_shadow_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit account changes,
run the following command:

auditctl -l | egrep '(/etc/shadow)'

If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).
      Is it the case that the system is not configured to audit account changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_access_var_log_audit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit accesses to
/var/log/audit directory, run the following command:
preserve$ sudo grep "dir=/var/log/audit" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-directory_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to check the mode of the system audit logs:
$ sudo ls -ld /var/log/audit
Audit log directories must be mode 0700 or less permissive.
      Is it the case that any are more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_var_log_audit_question:question:1">
          <ocil:question_text>
To properly set the owner of /var/log/audit, run the command:
$ sudo chown root /var/log/audit 

To properly set the owner of /var/log/audit/*, run the command:
$ sudo chown root /var/log/audit/* 
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_audit_question:question:1">
          <ocil:question_text>Run the following command to check the mode of the system audit logs:
$ sudo ls -l /var/log/audit
Audit logs must be mode 0640 or less permissive.
      Is it the case that any are more permissive?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
umount system call, run the following command:
preserve$ sudo grep "umount" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_dac_modification_umount2_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
umount2 system call, run the following command:
preserve$ sudo grep "umount2" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_chcon_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/bin/chcon" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/bin/chcon -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_restorecon_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/restorecon" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/restorecon -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_semanage_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/semanage" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/semanage -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_setsebool_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/setsebool" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/setsebool -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_execution_seunshare_question:question:1">
          <ocil:question_text>To verify that execution of the command is being audited, run the following command:
$ sudo grep "path=/usr/sbin/seunshare" /etc/audit/audit.rules /etc/audit/rules.d/*
The output should return something similar to:
-a always,exit -F path=/usr/sbin/seunshare -F auid&gt;=1000 -F auid!=unset -F key=privileged
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
preserve$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_rmdir_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rmdir system call, run the following command:
preserve$ sudo grep "rmdir" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_file_deletion_events_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the creat system call, run the following command:
preserve$ sudo grep "creat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_ftruncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the ftruncate system call, run the following command:
preserve$ sudo grep "ftruncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the open system call, run the following command:
preserve$ sudo grep "open" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_truncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the truncate system call, run the following command:
preserve$ sudo grep "truncate" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_successful_file_modification_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit successful calls
to the unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
          <ocil:question_text>To verify that the audit system collects unauthorized file accesses, run the following commands:
$ sudo grep EACCES /etc/audit/audit.rules
$ sudo grep EPERM /etc/audit/audit.rules
      Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chmod system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_chown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
chown system call, run the following command:
preserve$ sudo grep "chown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
creat system call, run the following command:
preserve$ sudo grep "creat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmod_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmod system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchmodat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchmodat system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchown system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fchownat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fchownat system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fremovexattr system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
fsetxattr system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
ftruncate system call, run the following command:
preserve$ sudo grep "ftruncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lchown_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lchown system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lremovexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lremovexattr system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_lsetxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
lsetxattr system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open_by_handle_at system call, run the following command:
preserve$ sudo grep "open_by_handle_at" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_open_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
open system call, run the following command:
preserve$ sudo grep "open" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
openat system call, run the following command:
preserve$ sudo grep "openat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_removexattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
removexattr system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_rename_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
rename system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_renameat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
renameat system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_setxattr_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
setxattr system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
truncate system call, run the following command:
preserve$ sudo grep "truncate" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlink_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlink system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_unlinkat_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
unlinkat system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
preserve$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
preserve$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_delete_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
delete_module system call, run the following command:
preserve$ sudo grep "delete_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_finit_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
finit_module system call, run the following command:
preserve$ sudo grep "finit_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_init_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
init_module system call, run the following command:
preserve$ sudo grep "init_module" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_faillock_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/run/faillock\|-w /var/run/faillock"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_lastlog_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/log/lastlog\|-w /var/log/lastlog"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_login_events_tallylog_question:question:1">
          <ocil:question_text>To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/var/log/tallylog\|-w /var/log/tallylog"
      Is it the case that there is not output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command for each local partition PART to find relevant
setuid / setgid programs:
$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null
Run the following command to verify entries in the audit rules for all programs
found with the previous command:
$ sudo grep path /etc/audit/audit.rules
It should be the case that all relevant setuid / setgid programs have a line
in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_at_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep '\bat\b' /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chage_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep chage /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_chsh_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep chsh /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_crontab_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep crontab /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_gpasswd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep gpasswd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_mount_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep mount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgidmap_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newgrp_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newgrp /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_newuidmap_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep newuidmap /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_passwd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep passwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_pt_chown_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep pt_chown /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_ssh_keysign_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep ssh-keysign /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_su_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep su /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudo_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep sudo /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_sudoedit_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep sudoedit /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_umount_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep umount /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_unix_chkpwd_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep unix_chkpwd /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_userhelper_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep userhelper /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_privileged_commands_usernetctl_question:question:1">
          <ocil:question_text>To verify that auditing of privileged command use is configured, run the
following command:
$ sudo grep usernetctl /etc/audit/audit.rules /etc/audit/rules.d/*
It should return a relevant line in the audit rules.
      Is it the case that it is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
adjtimex system call, run the following command:
preserve$ sudo grep "adjtimex" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
clock_settime system call, run the following command:
preserve$ sudo grep "clock_settime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit calls to the
settimeofday system call, run the following command:
preserve$ sudo grep "settimeofday" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.

      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_stime_question:question:1">
          <ocil:question_text>If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable
ocil: |
To determine if the system is configured to audit calls to the
stime system call, run the following command:
preserve$ sudo grep "stime" /etc/audit/audit.*
If the system is configured to audit this activity, it will return a line.
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
          <ocil:question_text>To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
$ sudo auditctl -l | grep "watch=/etc/localtime"
If the system is configured to audit this activity, it will return a line.
      Is it the case that the system is not configured to audit time changes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_configure_remote_server_question:question:1">
          <ocil:question_text>To verify the audispd plugin off-loads audit records onto a different system or
media from the system being audited, run the following command:

$ sudo grep -i remote_server /etc/audit/audisp-remote.conf

The output should return something similar to
remote_server = 
      Is it the case that audispd is not sending logs to a remote system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_encrypt_sent_records_question:question:1">
          <ocil:question_text>To verify the audispd plugin encrypts audit records off-loaded onto a different
system or media from the system being audited, run the following command:

$ sudo grep -i transport /etc/audit/audisp-remote.conf
The output should return the following:
transport = KRB5
      Is it the case that audispd is not encrypting audit records when sent over the network?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
          <ocil:question_text>To verify the audispd's syslog plugin is active, run the following command:

$ sudo grep active /etc/audit/plugins.d/syslog.conf

If the plugin is active, the output will show yes.
      Is it the case that it is not activated?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_error_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk errors:
disk_error_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_disk_full_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either log to syslog,
switch to single-user mode, execute a script,
or halt when the disk is out of space:
disk_full_action single
      Is it the case that the system is not configured to switch to single-user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to send email to an
account when it needs to notify an administrator:
action_mail_acct = 
      Is it the case that auditd is not configured to send emails per identified actions?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either suspend, switch to single user mode,
or halt when disk space has run low:
admin_space_left_action single
      Is it the case that the system is not configured to switch to single user mode for corrective action?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_flush_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
$ sudo grep flush /etc/audit/auditd.conf
flush = DATA
Acceptable values are DATA, and SYNC. The setting is
case-insensitive.
      Is it the case that auditd is not configured to synchronously write audit event data to disk?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how much data the system will retain in each audit log file:
$ sudo grep max_log_file /etc/audit/auditd.conf
max_log_file = 6
      Is it the case that the system audit data threshold has not been properly configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to rotate logs when they reach their
maximum size:
$ sudo grep max_log_file_action /etc/audit/auditd.conf
max_log_file_action rotate
      Is it the case that the system has not been properly configured to rotate audit logs?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine how many logs the system is configured to retain after rotation:
$ sudo grep num_logs /etc/audit/auditd.conf
num_logs = 5
      Is it the case that the system log file retention has not been properly configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to email the administrator when
disk space is starting to run low:
$ sudo grep space_left_action /etc/audit/auditd.conf
space_left_action
Acceptable values are email, suspend, single, and halt.
      Is it the case that the system is not configured to send an email to the system administrator when disk space is starting to run low?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_data_retention_space_left_percentage_question:question:1">
          <ocil:question_text>Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured correctly:
space_left PERCENTAGE%
      Is it the case that the system is not configured with a specific percentage to notify administrators of an issue?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_freq_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to flush to disk after
every 50 records, run the following command:
$ sudo grep freq /etc/audit/auditd.conf
The output should return the following:
freq = 50
      Is it the case that freq isn't set to 50?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_local_events_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to include local events, run the
following command:
$ sudo grep local_events /etc/audit/auditd.conf
The output should return the following:
local_events = yes
      Is it the case that local_events isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_log_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to resolve all uid, gid, syscall,
architecture, and socket address information before writing the event to disk,
run the following command:
$ sudo grep log_format /etc/audit/auditd.conf
The output should return the following:
log_format = ENRICHED
      Is it the case that log_format isn't set to ENRICHED?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_name_format_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to record the hostname
in audit events, run the following command:
$ sudo grep name_format /etc/audit/auditd.conf
The output should return the following:
name_format = hostname
      Is it the case that name_format isn't set to hostname?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_overflow_action_question:question:1">
          <ocil:question_text>Verify the audit system is configured to take an appropriate action when the internal event queue is full:
$ sudo grep -i overflow_action /etc/audit/auditd.conf

The output should contain be like overflow_action = syslog

If the value of the "overflow_action" option is not set to syslog, 
single, halt or the line is commented out, ask the System Administrator
to indicate how the audit logs are off-loaded to a different system or media. 
      Is it the case that auditd overflow action is not setup correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-auditd_write_logs_question:question:1">
          <ocil:question_text>To verify that Audit Daemon is configured to write logs to the disk, run the
following command:
$ sudo grep write_logs /etc/audit/auditd.conf
The output should return the following:
write_logs = yes
      Is it the case that write_logs isn't set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_pti_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include pti=on,
then Kernel page-table isolation is enabled at boot time.

To ensure pti=on is configured on all installed kernels, the
following command may be used:

$ sudo /sbin/grubby --update-kernel=ALL --args="pti=on

      Is it the case that Kernel page-table isolation is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_vsyscall_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include vsyscall=none,
then virtyal syscalls are not enabled at boot time.

To ensure vsyscall=none is configured on all installed kernels, the
following command may be used:

$ sudo /sbin/grubby --update-kernel=ALL --args="vsyscall=none

      Is it the case that vsyscalls are enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of {{{ grub2_boot_path }}}/grub.cfg,
run the command:
$ ls -lL {{{ grub2_boot_path }}}/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that {{{ grub2_boot_path }}}/grub.cfg has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of {{{ grub2_boot_path }}}/grub.cfg,
run the command:
$ ls -lL {{{ grub2_boot_path }}}/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that {{{ grub2_boot_path }}}/grub.cfg has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following
permissions: -rw-------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_admin_username_question:question:1">
          <ocil:question_text>To verify the boot loader superuser account has been set, run the following
command:
sudo grep -A1 "superusers" /etc/grub2.cfg
The output should show the following:
set superusers="superusers-account"
export superusers
where superusers-account is the actual account name different from common names like root,
admin, or administrator.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_password_question:question:1">
          <ocil:question_text>To verify the boot loader superuser password has been set, run the following
command:

sudo grep "superusers" /etc/grub2.cfg

The output should show the following:
password_pbkdf2 superusers-account ${GRUB2_PASSWORD}
To verify the boot loader superuser account password has been set,
and the password encrypted, run the following command:

sudo cat /boot/grub2/user.cfg
The output should be similar to:
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the group ownership of /boot/efi/EFI/fedora/grub.cfg,
run the command:
$ ls -lL /boot/efi/EFI/fedora/grub.cfg
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /boot/efi/EFI/fedora/grub.cfg has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the ownership of /boot/efi/EFI/fedora/grub.cfg,
run the command:
$ ls -lL /boot/efi/EFI/fedora/grub.cfg
If properly configured, the output should indicate the following owner:
root
      Is it the case that /boot/efi/EFI/fedora/grub.cfg has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_efi_grub2_cfg_question:question:1">
          <ocil:question_text>To check the permissions of /boot/efi/EFI/fedora/grub.cfg, run the command:
$ sudo ls -lL /boot/efi/EFI/fedora/grub.cfg

If properly configured, the output should indicate the following
permissions: -rwx------
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_uefi_admin_username_question:question:1">
          <ocil:question_text>To verify the boot loader superuser account has been set, run the following
command:
sudo grep -A1 "superusers" /etc/grub2-efi.cfg
The output should show the following:
set superusers="superusers-account"
export superusers
where superusers-account is the actual account name different from common names like root,
admin, or administrator.
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_uefi_password_question:question:1">
          <ocil:question_text>To verify the boot loader superuser password has been set, run the following
command:

sudo grep "password" /etc/grub2-efi.cfg

The output should show the following:
password_pbkdf2 superusers-account ${GRUB2_PASSWORD}
To verify the boot loader superuser account password has been set,
and the password encrypted, run the following command:

sudo cat /boot/grub2/user.cfg
The output should be similar to:
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC
2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0
916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7
0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog-gnutls_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog-gnutls package is installed: $ rpm -q rsyslog-gnutls
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the rsyslog package is installed: $ rpm -q rsyslog
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rsyslog service:
$ systemctl is-active rsyslog
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_cron_logging_question:question:1">
          <ocil:question_text>To verify that cron is logging to rsyslog,
run the following command:
grep -rni "cron\.\*" /etc/rsyslog.*
The output should return some similar to:
cron.*                                                  /var/log/cron
      Is it the case that cron is not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode_question:question:1">
          <ocil:question_text>Verify the operating system authenticates the remote logging server for off-loading audit logs with the following command:

$ sudo grep -i '$ActionSendStreamDriverAuthMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
$/etc/rsyslog.conf:$ActionSendStreamDriverAuthMode x509/name
      Is it the case that $ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$ActionSendStreamDriverMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
/etc/rsyslog.conf:$ActionSendStreamDriverMode 1
      Is it the case that rsyslogd ActionSendStreamDriverMode not set to 1?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver_question:question:1">
          <ocil:question_text>Verify the operating system encrypts audit records off-loaded onto a different system
or media from the system being audited with the following commands:

$ sudo grep -i '$DefaultNetstreamDriver' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should be
/etc/rsyslog.conf:$DefaultNetstreamDriver gtls
      Is it the case that rsyslogd DefaultNetstreamDriver not set to gtls?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
          <ocil:question_text>The group-owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the group-owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
          <ocil:question_text>The owner of all log files written by rsyslog should be .
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE
      Is it the case that the owner is not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
          <ocil:question_text>The file permissions for all log files written by rsyslog should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in /etc/rsyslog.conf and typically
all appear in /var/log. To see the permissions of a given log
file, run the following command:
$ ls -l LOGFILE
The permissions should be 600, or more restrictive.
      Is it the case that the permissions are not correct?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_access_monitoring_question:question:1">
          <ocil:question_text>To verify that remote access methods are logging to rsyslog,
run the following command:
grep -rE '(auth.\*|authpriv.\*|daemon.\*)' /etc/rsyslog.*
The output should contain auth.*, authpriv.*, and daemon.*
pointing to a log file.
      Is it the case that remote access methods are not logging to rsyslog?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
          <ocil:question_text>To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to
/etc/cron.daily.
      Is it the case that logrotate is not configured to run daily?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_syslogng_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the syslog-ng-core package is installed: $ rpm -q syslog-ng-core
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_syslogng_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
syslog-ng service:
$ systemctl is-active syslog-ng
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_nolisten_question:question:1">
          <ocil:question_text>Display the contents of the configuration file:
cat /etc/rsyslog.conf
Make sure that the following lines are not present in the output:
$ModLoad imtcp
$InputTCPServerRun port
$ModLoad imudp
$UDPServerRun port
$ModLoad imrelp
$InputRELPServerRun port
      Is it the case that rsyslog accepts remote messages?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
          <ocil:question_text>To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @
If using TCP, a line similar to the following should be present:
 *.* @@
If using RELP, a line similar to the following should be present:
 *.* :omrelp:
      Is it the case that none of these are present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module is configured
to use TLS for logging to remote server, run the following command:
$ grep omfwd /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
action(type="omfwd" protocol="tcp" Target="&lt;remote system&gt;" port="6514"
    StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")

where the &lt;remote system&gt; present in the configuration line above must be a valid IP address or a host name of the remote logging server.
      Is it the case that omfwd is not configured with gtls and AuthMode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-rsyslog_remote_tls_cacert_question:question:1">
          <ocil:question_text>To verify that rsyslog's Forwarding Output Module has CA certificate
configured for its TLS connections to remote server, run the following command:
$ grep DefaultNetstreamDriverCAFile /etc/rsyslog.conf /etc/rsyslog.d/*.conf
The output should include record similar to
global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")
where the path to the CA file (/etc/pki/tls/cert.pem in case above) must point to the correct CA certificate.
      Is it the case that CA certificate for rsyslog remote logging via TLS is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_nmcli_permissions_question:question:1">
          <ocil:question_text>Using a non-privileged account, verify that users cannot modify or change
network settings with the nmcli command with the following command:
$ nmcli general permissions
The output should contain the following:
PERMISSION                                                        VALUE
org.freedesktop.NetworkManager.enable-disable-network             auth
org.freedesktop.NetworkManager.enable-disable-wifi                auth
org.freedesktop.NetworkManager.enable-disable-wwan                auth
org.freedesktop.NetworkManager.enable-disable-wimax               auth
org.freedesktop.NetworkManager.sleep-wake                         auth
org.freedesktop.NetworkManager.network-control                    auth
org.freedesktop.NetworkManager.wifi.share.protected               auth
org.freedesktop.NetworkManager.wifi.share.open                    auth
org.freedesktop.NetworkManager.settings.modify.system             auth
org.freedesktop.NetworkManager.settings.modify.own                auth
org.freedesktop.NetworkManager.settings.modify.hostname           auth
org.freedesktop.NetworkManager.settings.modify.global-dns         auth
org.freedesktop.NetworkManager.reload                             auth
org.freedesktop.NetworkManager.checkpoint-rollback                auth
org.freedesktop.NetworkManager.enable-disable-statistics          auth
org.freedesktop.NetworkManager.enable-disable-connectivity-check  auth
org.freedesktop.NetworkManager.wifi.scan                          auth

      Is it the case that non-privileged users can modify or change network settings?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-network_sniffer_disabled_question:question:1">
          <ocil:question_text>To verify that Promiscuous mode of an interface is disabled, run the following command:
$ ip link | grep PROMISC
The output returned should not return any network device containing PROMISC.
      Is it the case that any network device is in promiscuous mode?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_firewalld_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
firewalld service:
$ systemctl is-active firewalld
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_firewalld_default_zone_question:question:1">
          <ocil:question_text>Inspect the file /etc/firewalld/firewalld.conf to determine
the default zone for the firewalld. It should be set to DefaultZone=drop:
$ sudo grep DefaultZone /etc/firewalld/firewalld.conf
      Is it the case that the default zone is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libreswan_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libreswan package is installed: $ rpm -q libreswan
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-libreswan_approved_tunnels_question:question:1">
          <ocil:question_text>To check for configured IPsec connections (conn), perform the following:
grep -rni conn /etc/ipsec.conf /etc/ipsec.d/
Verify any returned results for organizational approval.
      Is it the case that the IPSec tunnels are not approved?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_iptables_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the iptables package is installed: $ rpm -q iptables
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ip6tables_enabled_question:question:1">
          <ocil:question_text>If IPv6 is disabled, this is not applicable.



Run the following command to determine the current status of the
ip6tables service:
$ systemctl is-active ip6tables
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_iptables_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
iptables service:
$ systemctl is-active iptables
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_ip6tables_default_rule_question:question:1">
          <ocil:question_text>If IPv6 is disabled, this is not applicable.

Inspect the file /etc/sysconfig/ip6tables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/ip6tables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_question:question:1">
          <ocil:question_text>Inspect the file /etc/sysconfig/iptables to determine
the default policy for the INPUT chain. It should be set to DROP:
$ sudo grep ":INPUT" /etc/sysconfig/iptables
      Is it the case that the default policy for the INPUT chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-set_iptables_default_rule_forward_question:question:1">
          <ocil:question_text>Run the following command to ensure the default FORWARD policy is DROP:
grep ":FORWARD" /etc/sysconfig/iptables
The output should be similar to the following:
$ sudo grep ":FORWARD" /etc/sysconfig/iptables
:FORWARD DROP [0:0
      Is it the case that the default policy for the FORWARD chain is not set to DROP?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_ipv6_disable_argument_question:question:1">
          <ocil:question_text>
Inspect the form of default GRUB2 command line for the Linux operating system
in /boot/grub2/grubenv. Check if it includes ipv6.disable=1.
sudo grep 'kernelopts.*ipv6.disable=1.*' /boot/grub2/grubenv

To ensure ipv6.disable=1 is configured on all installed kernels, the
following command may be used:

sudo grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) ipv6.disable=1"

      Is it the case that IPv6 is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_ipv6_option_disabled_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to disable the
ipv6 kernel module, it will contain a line
of the form:
options ipv6 disable=1
Such lines may be inside any file in /etc/modprobe.d or the
deprecated/etc/modprobe.conf.  This permits insertion of the IPv6
kernel module (which other parts of the system expect to be present), but
otherwise keeps it inactive.  Run the following command to search for such
lines in all files in /etc/modprobe.d and the deprecated
/etc/modprobe.conf:
preserve$ grep -r ipv6 /etc/modprobe.conf /etc/modprobe.d
      Is it the case that the ipv6 kernel module is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.all.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps all network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled on all network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_disable_ipv6_question:question:1">
          <ocil:question_text>If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the ipv6 on
network interfaces, it will contain a line of the form:
net.ipv6.conf.default.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory.
This permits insertion of the IPv6 kernel module (which other parts of the
system expect to be present), but otherwise keeps network interfaces
from using IPv6. Run the following command to search for such lines in all
files in /etc/sysctl.d:
$ grep -r ipv6 /etc/sysctl.d
      Is it the case that the ipv6 support is disabled by default on network interfaces?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_defrtr
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_defrtr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_defrtr = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_defrtr = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.accept_ra_defrtr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_pinfo
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_pinfo\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_pinfo = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_pinfo = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.accept_ra_pinfo /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.accept_ra_rtr_pref
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.accept_ra_rtr_pref\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.accept_ra_rtr_pref = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.accept_ra_rtr_pref = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.accept_ra_rtr_pref /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.autoconf
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.autoconf\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.autoconf = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.autoconf = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.autoconf /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.max_addresses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.max_addresses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.max_addresses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.max_addresses = 1, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.max_addresses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.all.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.all.router_solicitations
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.all.router_solicitations\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.all.router_solicitations = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.all.router_solicitations = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.all.router_solicitations /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.accept_ra /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_defrtr kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_defrtr
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_defrtr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_defrtr = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_defrtr = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.accept_ra_defrtr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_pinfo kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_pinfo
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_pinfo\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_pinfo = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_pinfo = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.accept_ra_pinfo /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_ra_rtr_pref kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_ra_rtr_pref
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_ra_rtr_pref\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_ra_rtr_pref = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.accept_ra_rtr_pref = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.accept_ra_rtr_pref /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.accept_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_autoconf_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.autoconf kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.autoconf
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.autoconf\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.autoconf = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.autoconf = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.autoconf /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_max_addresses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.max_addresses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.max_addresses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.max_addresses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.max_addresses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.max_addresses = 1, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.max_addresses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_router_solicitations_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv6.conf.default.router_solicitations kernel parameter can be queried
by running the following command:
$ sysctl net.ipv6.conf.default.router_solicitations
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv6.conf.default.router_solicitations\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv6.conf.default.router_solicitations = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv6.conf.default.router_solicitations = 0, and that one assignment
is returned when 
$ grep -r net.ipv6.conf.default.router_solicitations /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.accept_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.accept_source_route
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.accept_source_route\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.accept_source_route = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.accept_source_route = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.log_martians
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.log_martians\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.log_martians = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.log_martians = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.log_martians /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.rp_filter
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.rp_filter = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.rp_filter = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.secure_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.secure_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.secure_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.secure_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.secure_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.accept_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.accept_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.accept_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.accept_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.accept_source_route
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.accept_source_route\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.accept_source_route = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.accept_source_route = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.log_martians kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.log_martians
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.log_martians\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.log_martians = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.log_martians = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.log_martians /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.rp_filter
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.rp_filter\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.rp_filter = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.rp_filter = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.secure_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.secure_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.secure_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.secure_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.secure_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.icmp_echo_ignore_broadcasts\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.icmp_echo_ignore_broadcasts = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.icmp_echo_ignore_broadcasts = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.icmp_ignore_bogus_error_responses
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.icmp_ignore_bogus_error_responses\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.icmp_ignore_bogus_error_responses = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.icmp_ignore_bogus_error_responses = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.icmp_ignore_bogus_error_responses /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_local_port_range_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_local_port_range kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_local_port_range
The output of the command should indicate a value of 32768 65535.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.ip_local_port_range\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.ip_local_port_range = 32768 65535
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.ip_local_port_range = 32768 65535, and that one assignment
is returned when 
$ grep -r net.ipv4.ip_local_port_range /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.tcp_syncookies kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.tcp_syncookies
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.tcp_syncookies\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.tcp_syncookies = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.tcp_syncookies = 1, and that one assignment
is returned when 
$ grep -r net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.all.send_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.all.send_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.all.send_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.all.send_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.all.send_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.conf.default.send_redirects
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.conf.default.send_redirects\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.conf.default.send_redirects = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.conf.default.send_redirects = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.conf.default.send_redirects /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
          <ocil:question_text>The runtime status of the net.ipv4.ip_forward kernel parameter can be queried
by running the following command:
$ sysctl net.ipv4.ip_forward
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.ipv4.ip_forward\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.ipv4.ip_forward = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.ipv4.ip_forward = 0, and that one assignment
is returned when 
$ grep -r net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d
is executed.
The ability to forward packets is only appropriate for routers.
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_atm_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the atm kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r atm /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_can_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the can kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r can /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the dccp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_firewire-core_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the firewire-core kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r firewire-core /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_rds_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the rds kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r rds /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_tipc_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the tipc kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r tipc /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_bluetooth_disabled_question:question:1">
          <ocil:question_text>
To check that the bluetooth service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled bluetooth
Output should indicate the bluetooth service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled bluetooth disabled

Run the following command to verify bluetooth is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active bluetooth

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the bluetooth is masked, run the following command:
$ systemctl show bluetooth | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the bluetooth kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-wireless_disable_interfaces_question:question:1">
          <ocil:question_text>Verify that there are no wireless interfaces configured on the system
with the following command:

$ sudo nmcli device
The output should contain the following:
wifi disconnected
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_root_owned_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not owned by root.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +0 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
          <ocil:question_text>To find world-writable directories that lack the sticky bit, run the following command:
$ sudo find / -xdev -type d -perm 002 ! -perm 1000
      Is it the case that any world-writable directories are missing the sticky bit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not owned by a system account, given the assumption that only system
accounts have a uid lower than 500.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +499 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_group_question:question:1">
          <ocil:question_text>The following command will discover and print world-writable directories that
are not group owned by a system account, given the assumption that only system
accounts have a gid lower than 1000.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -gid +999 -print
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_systemmap_question:question:1">
          <ocil:question_text>To check the permissions of /boot/Sysem.map-*,
run the command:
$ ls -l /boot/Sysem.map-*
If properly configured, the output should indicate the following permissions:
-rw-------
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
          <ocil:question_text>To find SGID files, run the following command:
$ sudo find / -xdev -type f -perm -2000
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
          <ocil:question_text>To find SUID files, run the following command:
$ sudo find / -xdev -type f -perm -4000
      Is it the case that only authorized files appear in the output of the find command?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
          <ocil:question_text>To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_ungroupowned_question:question:1">
          <ocil:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid group.
$ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup

Either remove all files and directories from the system that do not have a valid group,
or assign a valid group with the chgrp command:
$ sudo chgrp group file
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_files_unowned_by_user_question:question:1">
          <ocil:question_text>The following command will discover and print any
files on local partitions which do not belong to a valid user.
$ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser

Either remove all files and directories from the system that do not have a
valid user, or assign a valid user to all unowned files and directories on
the system with the chown command:
$ sudo chown user file
      Is it the case that files exist that are not owned by a valid user?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_hardlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_hardlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_hardlinks
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_hardlinks\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_hardlinks = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains fs.protected_hardlinks = 1, and that one assignment
is returned when 
$ grep -r fs.protected_hardlinks /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_protected_symlinks_question:question:1">
          <ocil:question_text>The runtime status of the fs.protected_symlinks kernel parameter can be queried
by running the following command:
$ sysctl fs.protected_symlinks
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.protected_symlinks\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.protected_symlinks = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains fs.protected_symlinks = 1, and that one assignment
is returned when 
$ grep -r fs.protected_symlinks /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group- has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow- has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd- has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow- has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_group_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/group has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/gshadow has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/passwd has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_etc_shadow_question:question:1">
          <ocil:question_text>To check the group ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /etc/shadow has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group-,
run the command:
$ ls -lL /etc/group-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group- has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow-,
run the command:
$ ls -lL /etc/gshadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow- has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd-,
run the command:
$ ls -lL /etc/passwd-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd- has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow-,
run the command:
$ ls -lL /etc/shadow-
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow- has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_group_question:question:1">
          <ocil:question_text>To check the ownership of /etc/group,
run the command:
$ ls -lL /etc/group
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/group has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_gshadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/gshadow,
run the command:
$ ls -lL /etc/gshadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/gshadow has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_passwd_question:question:1">
          <ocil:question_text>To check the ownership of /etc/passwd,
run the command:
$ ls -lL /etc/passwd
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/passwd has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_etc_shadow_question:question:1">
          <ocil:question_text>To check the ownership of /etc/shadow,
run the command:
$ ls -lL /etc/shadow
If properly configured, the output should indicate the following owner:
root
      Is it the case that /etc/shadow has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/group-,
run the command:
$ ls -l /etc/group-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group- has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow-,
run the command:
$ ls -l /etc/gshadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow- has unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd-,
run the command:
$ ls -l /etc/passwd-
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd- has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_backup_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow-,
run the command:
$ ls -l /etc/shadow-
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow- has unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd,
run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/group has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/gshadow,
run the command:
$ ls -l /etc/gshadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/gshadow has unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
          <ocil:question_text>To check the permissions of /etc/passwd,
run the command:
$ ls -l /etc/passwd
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/passwd has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
          <ocil:question_text>To check the permissions of /etc/shadow,
run the command:
$ ls -l /etc/shadow
If properly configured, the output should indicate the following permissions:
----------
      Is it the case that /etc/shadow has unix mode ----------?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupowner_var_log_messages_question:question:1">
          <ocil:question_text>To check the group ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following group-owner:
root
      Is it the case that /var/log/messages has group owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_question:question:1">
          <ocil:question_text>To check the ownership of /var/log,
run the command:
$ ls -lL /var/log
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_owner_var_log_messages_question:question:1">
          <ocil:question_text>To check the ownership of /var/log/messages,
run the command:
$ ls -lL /var/log/messages
If properly configured, the output should indicate the following owner:
root
      Is it the case that /var/log/messages has owner root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_question:question:1">
          <ocil:question_text>To check the permissions of /var/log,
run the command:
$ ls -l /var/log
If properly configured, the output should indicate the following permissions:
drwxr-xr-x
      Is it the case that /var/log has unix mode drwxr-xr-x?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_var_log_messages_question:question:1">
          <ocil:question_text>To check the permissions of /var/log/messages,
run the command:
$ ls -l /var/log/messages
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /var/log/messages has unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_group_ownership_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64
For each of these directories, run the following command to find files not
owned by root:
$ sudo find -L $DIR ! -user root -type d -exec chgrp root {} \;
      Is it the case that any of these directories are not group-owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_ownership_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64
For each of these directories, run the following command to find files not
owned by root:
$ sudo find -L $DIR ! -user root -type d -exec chown root {} \;
      Is it the case that any of these directories are not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-dir_permissions_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type d
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_groupownership_system_commands_dirs_question:question:1">
          <ocil:question_text>System commands are stored in the following directories:
/bin
/sbin
/usr/bin
/usr/sbin
/usr/local/bin
/usr/local/sbin
For each of these directories, run the following command to find files not
owned by root group:
$ sudo find -L $DIR ! -group root -type f \;
      Is it the case that any of these files are not owned by root group?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are not owned by root,
run the following command for each directory DIR which contains system executables:
$ sudo find DIR/ \! -user root
      Is it the case that any system executables are found to not be owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_ownership_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64
For each of these directories, run the following command to find files not
owned by root:
$ sudo find -L $DIR ! -user root -exec chown root {} \;
      Is it the case that any of these files are not owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_binary_dirs_question:question:1">
          <ocil:question_text>System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are group-writable or world-writable,
run the following command for each directory DIR which contains system executables:
$ sudo find -L DIR -perm /022 -type f
      Is it the case that any system executables are found to be group or world writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_library_dirs_question:question:1">
          <ocil:question_text>Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type f
      Is it the case that any of these files are group-writable or world-writable?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-root_permissions_syslibrary_files_question:question:1">
          <ocil:question_text>System-wide library files are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find if system-wide library files stored in these directories are not group-owned by
root run the following command for each directory DIR:
$ sudo find -L DIR ! -group root -type f 
      Is it the case that system wide library files are not group owned by root?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_autofs_disabled_question:question:1">
          <ocil:question_text>
To check that the autofs service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled autofs
Output should indicate the autofs service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled autofs disabled

Run the following command to verify autofs is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active autofs

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the autofs is masked, run the following command:
$ systemctl show autofs | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_cramfs_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the cramfs kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r cramfs /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
          <ocil:question_text>
If the system is configured to prevent the loading of the usb-storage kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as /bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d and the deprecated /etc/modprobe.conf:
$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d
      Is it the case that no line is returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_noauto_question:question:1">
          <ocil:question_text>To verify the noauto option is configured for the /boot mount point,
    run the following command:
    $ mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the noauto setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /boot mount point,
    run the following command:
    $ mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /boot mount point,
    run the following command:
    $ mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_boot_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /boot mount point,
    run the following command:
    $ mount | grep '\s/boot\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /dev/shm mount point,
    run the following command:
    $ mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /dev/shm mount point,
    run the following command:
    $ mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_dev_shm_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /dev/shm mount point,
    run the following command:
    $ mount | grep '\s/dev/shm\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_home_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /home mount point,
    run the following command:
    $ mount | grep '\s/home\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_nodev_nonroot_local_partitions_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for non-root local partitions, run the following command:
$ mount | grep '^/dev\S* on /\S' | grep --invert-match 'nodev'
The output shows local non-root partitions mounted without the nodev option, and there should be no output at all.

      Is it the case that some mounts appear among output lines?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
          <ocil:question_text>To verify that binaries cannot be directly executed from removable media, run the following command:
$ grep -v noexec /etc/fstab
The resulting output will show partitions which do not have the noexec flag. Verify all partitions
in the output are not removable media.
      Is it the case that removable media partitions are present?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_opt_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /opt mount point,
    run the following command:
    $ mount | grep '\s/opt\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_srv_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /srv mount point,
    run the following command:
    $ mount | grep '\s/srv\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /tmp mount point,
    run the following command:
    $ mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /tmp mount point,
    run the following command:
    $ mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_tmp_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /tmp mount point,
    run the following command:
    $ mount | grep '\s/tmp\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var/log/audit mount point,
    run the following command:
    $ mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var/log/audit mount point,
    run the following command:
    $ mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_audit_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var/log/audit mount point,
    run the following command:
    $ mount | grep '\s/var/log/audit\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var/log mount point,
    run the following command:
    $ mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var/log mount point,
    run the following command:
    $ mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_log_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var/log mount point,
    run the following command:
    $ mount | grep '\s/var/log\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nodev_question:question:1">
          <ocil:question_text>To verify the nodev option is configured for the /var mount point,
    run the following command:
    $ mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the nodev setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_noexec_question:question:1">
          <ocil:question_text>To verify the noexec option is configured for the /var mount point,
    run the following command:
    $ mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the noexec setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-mount_option_var_nosuid_question:question:1">
          <ocil:question_text>To verify the nosuid option is configured for the /var mount point,
    run the following command:
    $ mount | grep '\s/var\s'
    The output should show the corresponding mount point along with the nosuid setting in parentheses.

      Is it the case that the  is not present in the output line, or there is no output line at all?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_core_pattern_question:question:1">
          <ocil:question_text>The runtime status of the kernel.core_pattern kernel parameter can be queried
by running the following command:
$ sysctl kernel.core_pattern
The output of the command should indicate a value of |/bin/false.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.core_pattern\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.core_pattern = |/bin/false
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.core_pattern = |/bin/false, and that one assignment
is returned when 
$ grep -r kernel.core_pattern /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.dmesg_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.dmesg_restrict
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.dmesg_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.dmesg_restrict = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.dmesg_restrict = 1, and that one assignment
is returned when 
$ grep -r kernel.dmesg_restrict /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kexec_load_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kexec_load_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.kexec_load_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.kexec_load_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.kexec_load_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.kexec_load_disabled = 1, and that one assignment
is returned when 
$ grep -r kernel.kexec_load_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_modules_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.modules_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.modules_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.modules_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.modules_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.modules_disabled = 1, and that one assignment
is returned when 
$ grep -r kernel.modules_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_cpu_time_max_percent_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_cpu_time_max_percent kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_cpu_time_max_percent
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_cpu_time_max_percent\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_cpu_time_max_percent = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.perf_cpu_time_max_percent = 1, and that one assignment
is returned when 
$ grep -r kernel.perf_cpu_time_max_percent /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_max_sample_rate_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_max_sample_rate kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_max_sample_rate
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_event_max_sample_rate\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_event_max_sample_rate = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.perf_event_max_sample_rate = 1, and that one assignment
is returned when 
$ grep -r kernel.perf_event_max_sample_rate /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_perf_event_paranoid_question:question:1">
          <ocil:question_text>The runtime status of the kernel.perf_event_paranoid kernel parameter can be queried
by running the following command:
$ sysctl kernel.perf_event_paranoid
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.perf_event_paranoid\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.perf_event_paranoid = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.perf_event_paranoid = 2, and that one assignment
is returned when 
$ grep -r kernel.perf_event_paranoid /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_pid_max_question:question:1">
          <ocil:question_text>The runtime status of the kernel.pid_max kernel parameter can be queried
by running the following command:
$ sysctl kernel.pid_max
The output of the command should indicate a value of 65536.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.pid_max\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.pid_max = 65536
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.pid_max = 65536, and that one assignment
is returned when 
$ grep -r kernel.pid_max /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_sysrq_question:question:1">
          <ocil:question_text>The runtime status of the kernel.sysrq kernel parameter can be queried
by running the following command:
$ sysctl kernel.sysrq
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.sysrq\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.sysrq = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.sysrq = 0, and that one assignment
is returned when 
$ grep -r kernel.sysrq /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_unprivileged_bpf_disabled_question:question:1">
          <ocil:question_text>The runtime status of the kernel.unprivileged_bpf_disabled kernel parameter can be queried
by running the following command:
$ sysctl kernel.unprivileged_bpf_disabled
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.unprivileged_bpf_disabled\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.unprivileged_bpf_disabled = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.unprivileged_bpf_disabled = 1, and that one assignment
is returned when 
$ grep -r kernel.unprivileged_bpf_disabled /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_yama_ptrace_scope_question:question:1">
          <ocil:question_text>The runtime status of the kernel.yama.ptrace_scope kernel parameter can be queried
by running the following command:
$ sysctl kernel.yama.ptrace_scope
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.yama.ptrace_scope\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.yama.ptrace_scope = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.yama.ptrace_scope = 1, and that one assignment
is returned when 
$ grep -r kernel.yama.ptrace_scope /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_net_core_bpf_jit_harden_question:question:1">
          <ocil:question_text>The runtime status of the net.core.bpf_jit_harden kernel parameter can be queried
by running the following command:
$ sysctl net.core.bpf_jit_harden
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*net.core.bpf_jit_harden\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
net.core.bpf_jit_harden = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains net.core.bpf_jit_harden = 2, and that one assignment
is returned when 
$ grep -r net.core.bpf_jit_harden /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_user_max_user_namespaces_question:question:1">
          <ocil:question_text>The runtime status of the user.max_user_namespaces kernel parameter can be queried
by running the following command:
$ sysctl user.max_user_namespaces
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*user.max_user_namespaces\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
user.max_user_namespaces = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains user.max_user_namespaces = 0, and that one assignment
is returned when 
$ grep -r user.max_user_namespaces /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_vm_mmap_min_addr_question:question:1">
          <ocil:question_text>The runtime status of the vm.mmap_min_addr kernel parameter can be queried
by running the following command:
$ sysctl vm.mmap_min_addr
The output of the command should indicate a value of 65536.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*vm.mmap_min_addr\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
vm.mmap_min_addr = 65536
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains vm.mmap_min_addr = 65536, and that one assignment
is returned when 
$ grep -r vm.mmap_min_addr /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_systemd-coredump_disabled_question:question:1">
          <ocil:question_text>To verify that acquiring, saving, and processing core dumps is disabled, run the
following command:
$ systemctl status systemd-coredump.socket
The output should be similar to:
● systemd-coredump.socket
   Loaded: masked (Reason: Unit systemd-coredump.socket is masked.)
   Active: inactive (dead) ...

      Is it the case that unit systemd-coredump.socket is not masked or running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_backtraces_question:question:1">
          <ocil:question_text>To verify that logging core dump backtraces is disabled, run the
following command:
$ grep ProcessSizeMax /etc/systemd/coredump.conf
The output should be:
ProcessSizeMax=0
      Is it the case that ProcessSizeMax is not set to zero?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coredump_disable_storage_question:question:1">
          <ocil:question_text>To verify that storing core dumps are disabled, run the following command:
$ grep Storage /etc/systemd/coredump.conf
The output should be:
Storage=none
      Is it the case that Storage is not set to none?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_users_coredumps_question:question:1">
          <ocil:question_text>To verify that core dumps are disabled for all users, run the following command:
$ grep core /etc/security/limits.conf
The output should be:
*     hard   core    0
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
          <ocil:question_text>The runtime status of the fs.suid_dumpable kernel parameter can be queried
by running the following command:
$ sysctl fs.suid_dumpable
The output of the command should indicate a value of 0.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*fs.suid_dumpable\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
fs.suid_dumpable = 0
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains fs.suid_dumpable = 0, and that one assignment
is returned when 
$ grep -r fs.suid_dumpable /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-umask_for_daemons_question:question:1">
          <ocil:question_text>To check the value of the umask, run the following command:
$ grep umask /etc/init.d/functions
The output should show .
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
          <ocil:question_text>To verify ExecShield is enabled on 64-bit Red Hat Enterprise Linux 7 systems,
run the following command:
$ dmesg | grep '[NX|DX]*protection'
The output should not contain 'disabled by kernel command line option'.
To verify that ExecShield has not been disabled in the kernel configuration,
run the following command:
$ sudo grep noexec /boot/grub2/grub.cfg
The output should not return noexec=off.
For 32-bit Red Hat Enterprise Linux 7 systems, run the following command:
$ sysctl kernel.exec-shield
The output should be:
To set the runtime status of the kernel.exec-shield kernel parameter,
run the following command:
$ sudo sysctl -w kernel.exec-shield=1

To make sure that the setting is persistent,
add the following line to a file in the directory /etc/sysctl.d:
kernel.exec-shield = 1
      Is it the case that ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_kptr_restrict_question:question:1">
          <ocil:question_text>The runtime status of the kernel.kptr_restrict kernel parameter can be queried
by running the following command:
$ sysctl kernel.kptr_restrict
The output of the command should indicate a value of 1.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.kptr_restrict\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.kptr_restrict = 1
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.kptr_restrict = 1, and that one assignment
is returned when 
$ grep -r kernel.kptr_restrict /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
          <ocil:question_text>The runtime status of the kernel.randomize_va_space kernel parameter can be queried
by running the following command:
$ sysctl kernel.randomize_va_space
The output of the command should indicate a value of 2.
The preferable way how to assure the runtime compliance is to have
correct persistent configuration, and rebooting the system.

The persistent kernel parameter configuration is performed by specifying the appropriate
assignment in any file located in the /etc/sysctl.d directory.
Verify that there is not any existing incorrect configuration by executing the following command:
$ grep -r '^\s*kernel.randomize_va_space\s*=' /etc/sysctl.conf /etc/sysctl.d
If any assignments other than
kernel.randomize_va_space = 2
are found, or the correct assignment is duplicated, remove those offending lines from respective files,
and make sure that exactly one file in 
/etc/sysctl.d contains kernel.randomize_va_space = 2, and that one assignment
is returned when 
$ grep -r kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d
is executed.

      Is it the case that the correct value is not returned?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_page_poison_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include page_poison=1,
then page poisoning is enabled at boot time.

To ensure page_poison=1 is configured on all installed kernels, the
following command may be used:

$ sudo /sbin/grubby --update-kernel=ALL --args="page_poison=1

      Is it the case that page allocator poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_slub_debug_argument_question:question:1">
          <ocil:question_text>Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include slub_debug=P,
then SLUB/SLAB poisoning is enabled at boot time.

To ensure slub_debug=P is configured on all installed kernels, the
following command may be used:

$ sudo /sbin/grubby --update-kernel=ALL --args="slub_debug=P

      Is it the case that SLUB/SLAB poisoning is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_libselinux_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the libselinux package is installed: $ rpm -q libselinux
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_policycoreutils_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the policycoreutils package is installed: $ rpm -q policycoreutils
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-plugins_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-plugins package is installed:
$ rpm -q setroubleshoot-plugins
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_setroubleshoot-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the setroubleshoot-server package is installed:
$ rpm -q setroubleshoot-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-coreos_enable_selinux_kernel_argument_question:question:1">
          <ocil:question_text>Inspect /proc/cmdline for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.

If it would be disabled anywhere, make sure to enable it via a
MachineConfig object.
      Is it the case that SELinux is disabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-grub2_enable_selinux_question:question:1">
          <ocil:question_text>Inspect /etc/default/grub for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.
      Is it the case that SELinux is disabled at boot time?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
          <ocil:question_text>To check for incorrectly labeled device files, run following commands:
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
$ sudo find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_confinement_of_daemons_question:question:1">
          <ocil:question_text>Ensure there are no unconfined daemons running on the system,
the following command should produce no output:
$ sudo ps -eZ | grep "unconfined_service_t"
      Is it the case that There are unconfined daemons running on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_policytype_question:question:1">
          <ocil:question_text>Check the file /etc/selinux/config and ensure the following line appears:
SELINUXTYPE=
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-selinux_state_question:question:1">
          <ocil:question_text>Check the file /etc/selinux/config and ensure the following line appears:
SELINUX=
      Is it the case that SELINUX is not set to enforcing?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_abrt_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the abrt package is installed:
$ rpm -q abrt
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_cron_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
cron service:
$ systemctl is-active cron
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_crond_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
crond service:
$ systemctl is-active crond
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_atd_disabled_question:question:1">
          <ocil:question_text>
To check that the atd service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled atd
Output should indicate the atd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled atd disabled

Run the following command to verify atd is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active atd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the atd is masked, run the following command:
$ systemctl show atd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_anacron_question:question:1">
          <ocil:question_text>Run the following command to determine if the cronie-anacron package is installed:
$ rpm -q cronie-anacron
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_bind_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the bind package is installed:
$ rpm -q bind
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_fapolicyd_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the fapolicyd package is installed: $ rpm -q fapolicyd
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_vsftpd_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the vsftpd package is installed:
$ rpm -q vsftpd
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ftp_log_transactions_question:question:1">
          <ocil:question_text>Find if logging is applied to the FTP daemon.

Procedures:

If vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:
$ grep vsftpd /etc/xinetd.d/*
$ grep server_args vsftpd xinetd.d startup file
This will indicate the vsftpd config file used when starting through xinetd.
If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
$ sudo grep xferlog_enable vsftpd config file
      Is it the case that xferlog_enable is missing, or is not set to yes?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ftp_present_banner_question:question:1">
          <ocil:question_text>If FTP services are not installed, this is not applicable.

To verify this configuration, run the following command:

grep "banner_file" /etc/vsftpd/vsftpd.conf


The output should show the value of banner_file is set to /etc/issue, an example of which is shown below:

$ sudo grep "banner_file" /etc/vsftpd/vsftpd.conf

banner_file=/etc/issue
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-kerberos_disable_no_keytab_question:question:1">
          <ocil:question_text>Run the following command to see if there are some keytabs
that would potentially allow the use of Kerberos by system daemons.
$ ls -la /etc/*.keytab
The expected result is
ls: cannot access '/etc/*.keytab': No such file or directory
      Is it the case that it is present on the system?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openldap-clients_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openldap-clients package is installed:
$ rpm -q openldap-clients
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sendmail_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sendmail package is installed:
$ rpm -q sendmail
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_mail_alias_question:question:1">
          <ocil:question_text>Find the list of alias maps used by the Postfix mail server:
$ sudo postconf alias_maps
Query the Postfix alias maps for an alias for the root user:
$ sudo postmap -q root hash:/etc/aliases
The output should return an alias.
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-postfix_client_configure_relayhost_question:question:1">
          <ocil:question_text>Run the following command to ensure postfix routes mail to this system:
$ grep relayhost /etc/postfix/main.cf
If properly configured, the output should show only .
      Is it the case that it is not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_nfs-utils_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the nfs-utils package is installed:
$ rpm -q nfs-utils
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_nfs_disabled_question:question:1">
          <ocil:question_text>
To check that the nfs-server service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled nfs-server
Output should indicate the nfs-server service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled nfs-server disabled

Run the following command to verify nfs-server is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active nfs-server

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the nfs-server is masked, run the following command:
$ systemctl show nfs-server | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that it does not?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
          <ocil:question_text>
To check that the rpcsvcgssd service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled rpcsvcgssd
Output should indicate the rpcsvcgssd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled rpcsvcgssd disabled

Run the following command to verify rpcsvcgssd is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active rpcsvcgssd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rpcsvcgssd is masked, run the following command:
$ systemctl show rpcsvcgssd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-nfs_no_anonymous_question:question:1">
          <ocil:question_text>Inspect the mounts configured in /etc/exports. Each mount should specify a value
greater than UID_MAX and GID_MAX as defined in /etc/login.defs.
      Is it the case that anonuid or anongid are not set to a value greater than UID_MAX (for anonuid) and GID_MAX (for anongid)?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_all_squash_exports_question:question:1">
          <ocil:question_text>To verify all squashing has been disabled, run the following command:
$ grep all_squash /etc/exports
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_insecure_locks_exports_question:question:1">
          <ocil:question_text>To verify insecure file locking has been disabled, run the following command:
$ grep insecure_locks /etc/exports
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_chrony_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the chrony package is installed:
$ rpm -q chrony
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_chronyd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
chronyd service:
$ systemctl is-active chronyd
If the service is running, it should return the following: active
      Is it the case that the chronyd process is not running?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
chronyd service:
$ systemctl is-active chronyd
If the service is running, it should return the following: active


Run the following command to determine the current status of the
ntpd service:
$ systemctl is-active ntpd
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ntp_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
ntp service:
$ systemctl is-active ntp
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_ntpd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
ntpd service:
$ systemctl is-active ntpd
If the service is running, it should return the following: active
      Is it the case that ?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_client_only_question:question:1">
          <ocil:question_text>To verify that port has been set properly, perform the following:
$ grep '\bport\b' /etc/chrony.conf
The output should return
port 0
      Is it the case that it does not exist or port is set to non-zero value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_no_chronyc_network_question:question:1">
          <ocil:question_text>To verify that cmdport has been set properly, perform the following:
$ grep '\bcmdport\b' /etc/chrony.conf
The output should return
cmdport 0
      Is it the case that it does not exist or port is set to non-zero value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_or_ntpd_set_maxpoll_question:question:1">
          <ocil:question_text>To verify that maxpoll has been set properly, perform the following:
$ sudo grep maxpoll /etc/ntp.conf /etc/chrony.conf
The output should return
maxpoll .
      Is it the case that it does not exist or maxpoll has not been set to the expected value?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
          <ocil:question_text>To verify that a remote NTP service is configured for time synchronization,
open the following file:
/etc/chrony.conf in the case the system in question is
configured to use the chronyd as the NTP daemon (default setting)/etc/ntp.conf in the case the system in question is configured
to use the ntpd as the NTP daemon
In the file, there should be a section similar to the following:
server ntpserver
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_run_as_chrony_user_question:question:1">
          <ocil:question_text>Run the following command and verify that -u chrony is included in OPTIONS:
# grep "^OPTIONS" /etc/sysconfig/chronyd
OPTIONS="-u chrony"
      Is it the case that chronyd is not running under chrony user account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-chronyd_specify_remote_server_question:question:1">
          <ocil:question_text>Run the following command and verify remote server is configured properly:
# grep -E "^(server|pool)" /etc/chrony.conf
      Is it the case that a remote time server is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_configure_restrictions_question:question:1">
          <ocil:question_text>Run the following command and verify output matches:
# grep "^restrict" /etc/ntp.conf

restrict -4 default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery

The -4 in the first line is optional and options after default can appear in any order.
Additional restriction lines may exist.
      Is it the case that restrictions are not configured for ntpd?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_run_as_ntp_user_question:question:1">
          <ocil:question_text>To verify that ntpd is configured to correctly run under the ntp user,
run the following commands:
$ sudo grep "^OPTIONS" /etc/sysconfig/ntpd
The output should contain
OPTIONS="-u ntp:ntp"
$ sudo grep "^ExecStart" /usr/lib/systemd/system/ntpd.service
The output should contain
ExecStart=/usr/sbin/ntpd -u ntp:ntp $OPTIONS
      Is it the case that ntpd is not running under ntp user account?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-ntpd_specify_remote_server_question:question:1">
          <ocil:question_text>To verify that a remote NTP service is configured for time synchronization,
open the following file:
/etc/ntp.conf
In the file, there should be a section similar to the following:
server ntpserver
      Is it the case that this is not the case?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rsyncd_disabled_question:question:1">
          <ocil:question_text>
To check that the rsyncd service is disabled in system boot configuration,
run the following command:
$ systemctl is-enabled rsyncd
Output should indicate the rsyncd service has either not been installed,
or has been disabled at all runlevels, as shown in the example below:
$ systemctl is-enabled rsyncd disabled

Run the following command to verify rsyncd is not active (i.e. not running) through current runtime configuration:
$ systemctl is-active rsyncd

If the service is not running the command will return the following output:
inactive

The service will also be masked, to check that the rsyncd is masked, run the following command:
$ systemctl show rsyncd | grep "LoadState\|UnitFileState"

If the service is masked the command will return the following outputs:

LoadState=masked

UnitFileState=masked
      Is it the case that the service is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-no_rsh_trust_files_question:question:1">
          <ocil:question_text>The existence of the file /etc/hosts.equiv or a file named
.rhosts inside a user home directory indicates the presence
of an Rsh trust relationship.
      Is it the case that these files exist?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_rngd_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
rngd service:
$ systemctl is-active rngd
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_net-snmp_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the net-snmp package is installed:
$ rpm -q net-snmp
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_no_rwusers_question:question:1">
          <ocil:question_text>To ensure there are no read-write users, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep 'rwuser'
There should be no output.
      Is it the case that there are users who can write to SNMP values?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_not_default_password_question:question:1">
          <ocil:question_text>To ensure the default password is not set, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep -E 'public|private'
There should be no output.
      Is it the case that the default SNMP passwords public and private have not been changed or removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
          <ocil:question_text>To ensure only SNMPv3 or newer is used, run the following command:
$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"
There should be no output.
      Is it the case that there is output?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_openssh-server_removed_question:question:1">
          <ocil:question_text>Run the following command to determine if the openssh-server package is installed: $ rpm -q openssh-server
      Is it the case that the package is installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*_key,
run the command:
$ ls -l /etc/ssh/*_key
If properly configured, the output should indicate the following permissions:
-rw-r-----
      Is it the case that /etc/ssh/*_key has unix mode -rw-r-----?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
          <ocil:question_text>To check the permissions of /etc/ssh/*.pub,
run the command:
$ ls -l /etc/ssh/*.pub
If properly configured, the output should indicate the following permissions:
-rw-r--r--
      Is it the case that /etc/ssh/*.pub has unix mode -rw-r--r--?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-disable_host_auth_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's HostbasedAuthentication option is set, run the following command:
$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of openssh-server with following command:

$ rpm -qi openssh-server | grep Version

Versions equal to or higher than 7.4 only allow Protocol 2.
If version is lower than 7.4, run the following command to check configuration:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2
      Is it the case that it is commented out or is not set correctly to Protocol 2?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_compression_question:question:1">
          <ocil:question_text>To check if compression is enabled or set correctly, run the
following command:
$ sudo grep Compression /etc/ssh/sshd_config
If configured properly, output should be no or delayed.
      Is it the case that it is commented out, or is not set to no or delayed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitEmptyPasswords option is set, run the following command:
$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
          <ocil:question_text>To check if GSSAPIAuthentication is disabled or set correctly, run the following
command:
$ sudo grep GSSAPIAuthentication /etc/ssh/sshd_config
If configured properly, output should be no
      Is it the case that it is commented out or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
          <ocil:question_text>To check if KerberosAuthentication is disabled or set correctly, run the
following command:
$ sudo grep KerberosAuthentication /etc/ssh/sshd_config
If configured properly, output should be no
      Is it the case that it is commented out or is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_pubkey_auth_question:question:1">
          <ocil:question_text>To check if PubkeyAuthentication is disabled or set correctly, run the following
command:
$ sudo grep PubkeyAuthentication /etc/ssh/sshd_config
If configured properly, output should be no
      Is it the case that it is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreRhosts option is set, run the following command:
$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
          <ocil:question_text>To check which SSH protocol version is allowed, check version of
openssh-server with following command:
$ rpm -qi openssh-server | grep Version
Versions equal to or higher than 7.4 have deprecated the RhostsRSAAuthentication option.
If version is lower than 7.4, run the following command to check configuration:
To determine how the SSH daemon's RhostsRSAAuthentication option is set, run the following command:
$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:
$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_root_password_login_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's PermitRootLogin option is set, run the following command:
$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config

If a line indicating prohibit-password is returned, then the required value is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_tcp_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's AllowTcpForwarding option is set, run the following command:
$ sudo grep -i AllowTcpForwarding /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.
      Is it the case that The AllowTcpForwarding option exists and is disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's IgnoreUserKnownHosts option is set, run the following command:
$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_disable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:
$ sudo grep -i X11Forwarding /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value no is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
          <ocil:question_text>To ensure users are not able to send environment variables, run the following command:
$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config
If properly configured, output should be:
PermitUserEnvironment no
      Is it the case that PermitUserEnvironment is not disabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_gssapi_auth_question:question:1">
          <ocil:question_text>To check if GSSAPIAuthentication is enabled or set correctly, run the following
command:
$ sudo grep GSSAPIAuthentication /etc/ssh/sshd_config
If configured properly, output should be yes
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_strictmodes_question:question:1">
          <ocil:question_text>To check if StrictModes is enabled or set correctly, run the
following command:
$ sudo grep StrictModes /etc/ssh/sshd_config
If configured properly, output should be yes
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_warning_banner_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's Banner option is set, run the following command:
$ sudo grep -i Banner /etc/ssh/sshd_config

If a line indicating /etc/issue is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_enable_x11_forwarding_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11Forwarding option is set, run the following command:
$ sudo grep -i X11Forwarding /etc/ssh/sshd_config

If a line indicating yes is returned, then the required value is set.

      Is it the case that the required value is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_limit_user_access_question:question:1">
          <ocil:question_text>To ensure sshd limits the users who can log in, run the following:
$ sudo grep AllowUsers /etc/ssh/sshd_config
If properly configured, the output should be a list of usernames allowed to log in
to this system.
      Is it the case that sshd does not limit the users who can log in?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_print_last_log_question:question:1">
          <ocil:question_text>To check if PrintLastLog is enabled or set correctly, run the
following command:
$ sudo grep PrintLastLog /etc/ssh/sshd_config
If configured properly, output should be yes
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_rekey_limit_question:question:1">
          <ocil:question_text>To check if RekeyLimit is set correctly, run the
following command:
$ sudo grep RekeyLimit /etc/ssh/sshd_config
If configured properly, output should be
RekeyLimit  
      Is it the case that it is commented out or is not set?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
          <ocil:question_text>Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveCountMax 
For SSH earlier than v8.2, a ClientAliveCountMax value of 0 causes an idle timeout precisely when
the ClientAliveInterval is set.  Starting with v8.2, a value of 0 disables the timeout
functionality completely.
If the option is set to a number greater than 0, then the idle session will be disconnected after
ClientAliveInterval * ClientAliveCountMax seconds.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_keepalive_0_question:question:1">
          <ocil:question_text>To ensure ClientAliveInterval is set correctly, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveCountMax 0

In this case, the SSH idle timeout occurs precisely when
the ClientAliveInterval is set.
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_info_question:question:1">
          <ocil:question_text>To check if LogLevel is enabled or set correctly, run the
following command:
$ sudo grep "^LogLevel" /etc/ssh/sshd_config
If configured properly, output should be LogLevel INFO
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_loglevel_verbose_question:question:1">
          <ocil:question_text>To check if LogLevel is enabled or set correctly, run the
following command:
$ sudo grep "^LogLevel" /etc/ssh/sshd_config
If configured properly, output should be LogLevel VERBOSE
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_auth_tries_question:question:1">
          <ocil:question_text>To ensure the MaxAuthTries parameter is set, run the following command:
$ sudo grep MaxAuthTries /etc/ssh/sshd_config
If properly configured, output should be:
MaxAuthTries 
      Is it the case that it is commented out or not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_max_sessions_question:question:1">
          <ocil:question_text>Run the following command to see what the max sessions number is:
$ sudo grep MaxSessions /etc/ssh/sshd_config
If properly configured, the output should be:
MaxSessions 
      Is it the case that MaxSessions is not configured or not configured correctly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_set_maxstartups_question:question:1">
          <ocil:question_text>To check if MaxStartups is configured, run the following command:
$ sudo grep MaxStartups /etc/ssh/sshd_config
If configured, this command should output the configuration.
      Is it the case that maxstartups is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_directory_configuration_question:question:1">
          <ocil:question_text>To determine whether the SSH server includes configuration files from the right directory, run the following command:
$ sudo grep -i '^Include' /etc/ssh/sshd_config
If a line Include /etc/ssh/sshd_config.d/*.conf is returned, then the configuration file inclusion is set correctly.
      Is it the case that you don't include other configuration files from the main configuration file?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_use_priv_separation_question:question:1">
          <ocil:question_text>To check if UsePrivilegeSeparation is enabled or set correctly, run the
following command:
$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config
If configured properly, output should be .
      Is it the case that it is commented out or is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sshd_x11_use_localhost_question:question:1">
          <ocil:question_text>To determine how the SSH daemon's X11UseLocalhost option is set, run the following command:
$ sudo grep -i X11UseLocalhost /etc/ssh/sshd_config
If no line, a commented line, or a line indicating the value yes is returned, then the required value is set.
      Is it the case that the display proxy is listening on wildcard address?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_sssd-ipa_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the sssd-ipa package is installed: $ rpm -q sssd-ipa
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_certificate_verification_question:question:1">
          <ocil:question_text>Check to see if Online Certificate Status Protocol (OCSP)
is enabled and using the proper digest value on the system with the following command:
$ sudo grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf | grep -v "^#"
If configured properly, output should look like

    certificate_verification = ocsp_dgst=sha1

The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:
$ sudo systemctl restart sssd.service
      Is it the case that certificate_verification in sssd is not configured?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_certmap_question:question:1">
          <ocil:question_text>To verify Certmap is enabled in SSSD, run the following command:
$ cat sudo cat /etc/sssd/sssd.conf
If configured properly, output should contain section like the following

[certmap/testing.test/rule_name]
matchrule =&lt;SAN&gt;.*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test

      Is it the case that Certmap is not configured in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_enable_smartcards_question:question:1">
          <ocil:question_text>To verify that smart cards are enabled in SSSD, run the following command:
$ sudo grep pam_cert_auth /etc/sssd/sssd.conf
If configured properly, output should be
pam_cert_auth = true
      Is it the case that smart cards are not enabled in SSSD?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_memcache_timeout_question:question:1">
          <ocil:question_text>To verify that SSSD's in-memory cache expires after a day, run the following command:
$ sudo grep memcache_timeout /etc/sssd/sssd.conf
If configured properly, output should be memcache_timeout = .
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
          <ocil:question_text>To verify that SSSD expires offline credentials, run the following command:
$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf
If configured properly, output should be
offline_credentials_expiration = 1
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_run_as_sssd_user_question:question:1">
          <ocil:question_text>To verify that SSSD is configured to run as user sssd, run the following command:
$ sudo grep -r '\buser\b' /etc/sssd
If configured properly, output should similar to /etc/sssd/conf.d/ospp.conf:user = sssd.
Sanity of SSSD configuration in general can be checked using $ sudo sssctl config-check
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
          <ocil:question_text>To verify that SSSD expires known SSH host keys, run the following command:
$ sudo grep ssh_known_hosts_timeout /etc/sssd/sssd.conf
If configured properly, output should be
ssh_known_hosts_timeout = 
      Is it the case that it does not exist or is not configured properly?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_usbguard_installed_question:question:1">
          <ocil:question_text>Run the following command to determine if the usbguard package is installed: $ rpm -q usbguard
      Is it the case that the package is not installed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-service_usbguard_enabled_question:question:1">
          <ocil:question_text>

Run the following command to determine the current status of the
usbguard service:
$ systemctl is-active usbguard
If the service is running, it should return the following: active
      Is it the case that the service is not enabled?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-configure_usbguard_auditbackend_question:question:1">
          <ocil:question_text>To verify that Linux Audit logging si enabled for the USBGuard daemon,
run the following command:
$ sudo grep AuditBackend /etc/usbguard/usbguard-daemon.conf
The output should be
AuditBackend=LinuxAudit
      Is it the case that AuditBackend is not set to LinuxAudit?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hid_question:question:1">
          <ocil:question_text>To verify that USB Human Interface Devices will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
The output lines should include
allow with-interface match-all { 03:*:* }
      Is it the case that USB devices of class 3 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hid_and_hub_question:question:1">
          <ocil:question_text>To verify that USB Human Interface Devices and hubs will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
The output lines should include
allow with-interface match-all { 03:*:* 09:00:* }
      Is it the case that USB devices of class 3 and 9:00 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-usbguard_allow_hub_question:question:1">
          <ocil:question_text>To verify that USB hubs will be authorized by the USBGuard daemon,
run the following command:
$ sudo grep allow /etc/usbguard/rules.conf
One of the output lines should be
allow with-interface match-all { 09:00:* }
      Is it the case that USB devices of class 9 are not authorized?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
          <ocil:question_text>To ensure the X Windows package group is removed, run the following command:
$ rpm -qi xorg-x11-server-common
The output should be:
package xorg-x11-server-common is not installed
      Is it the case that the X Windows package group or xorg-x11-server-common has not be removed?
      </ocil:question_text>
        </ocil:boolean_question>
        <ocil:boolean_question id="ocil:ssg-xwindows_runlevel_target_question:question:1">
          <ocil:question_text>To verify the default target is multi-user, run the following command:
$ systemctl get-default
The output should show the following:
multi-user.target
      Is it the case that the X windows display server is running and/or has not been disabled?
      </ocil:question_text>
        </ocil:boolean_question>
      </ocil:questions>
    </ocil:ocil>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml" timestamp="2021-09-30T00:00:00">
    <xccdf-1.2:Benchmark id="xccdf_org.ssgproject.content_benchmark_FEDORA" resolved="1" xml:lang="en-US" style="SCAP_1.2">
      <xccdf-1.2:status date="2021-09-30">draft</xccdf-1.2:status>
      <xccdf-1.2:title xml:lang="en-US">Guide to the Secure Configuration of Fedora</xccdf-1.2:title>
      <xccdf-1.2:description xml:lang="en-US">This guide presents a catalog of security-relevant
configuration settings for Fedora. It is a rendering of
content structured in the eXtensible Configuration Checklist Description Format (XCCDF)
in order to support security automation.  The SCAP content is
is available in the <html:code>scap-security-guide</html:code> package which is developed at

    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>.
<html:br/><html:br/>
Providing system administrators with such guidance informs them how to securely
configure systems under their control in a variety of network roles. Policy
makers and baseline creators can use this catalog of settings, with its
associated references to higher-level security control catalogs, in order to
assist them in security baseline creation. This guide is a <html:em>catalog, not a
checklist</html:em>, and satisfaction of every item is not likely to be possible or
sensible in many operational scenarios. However, the XCCDF format enables
granular selection and adjustment of settings, and their association with OVAL
and OCIL content provides an automated checking capability. Transformations of
this document, and its associated automated checking content, are capable of
providing baselines that meet a diverse set of policy objectives. Some example
XCCDF <html:em>Profiles</html:em>, which are selections of items that form checklists and
can be used as baselines, are available with this guide. They can be
processed, in an automated fashion, with tools that support the Security
Content Automation Protocol (SCAP). The DISA STIG, which provides required
settings for US Department of Defense systems, is one example of a baseline
created from this guidance.
</xccdf-1.2:description>
      <xccdf-1.2:notice xml:lang="en-US" id="terms_of_use">Do not attempt to implement any of the settings in
this guide without first testing them in a non-operational environment. The
creators of this guidance assume no responsibility whatsoever for its use by
other parties, and makes no guarantees, expressed or implied, about its
quality, reliability, or any other characteristic.
</xccdf-1.2:notice>
      <xccdf-1.2:front-matter xml:lang="en-US">The SCAP Security Guide Project<html:br/>

    <html:a href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a>
</xccdf-1.2:front-matter>
      <xccdf-1.2:rear-matter xml:lang="en-US">Red Hat and Red Hat Enterprise Linux are either registered
trademarks or trademarks of Red Hat, Inc. in the United States and other
countries. All other names are registered trademarks or trademarks of their
respective companies.
</xccdf-1.2:rear-matter>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:35"/>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:34"/>
      <xccdf-1.2:platform idref="cpe:/o:fedoraproject:fedora:33"/>
      <xccdf-1.2:version update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.58</xccdf-1.2:version>
      <xccdf-1.2:metadata>
        <dc:publisher>SCAP Security Guide Project</dc:publisher>
        <dc:creator>SCAP Security Guide Project</dc:creator>
        <dc:contributor>Frank J Cameron (CAM1244) &lt;cameron@ctc.com&gt;</dc:contributor>
        <dc:contributor>0x66656c6978 &lt;0x66656c6978@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Jack Adolph &lt;jack.adolph@gmail.com&gt;</dc:contributor>
        <dc:contributor>Gabe Alford &lt;redhatrises@gmail.com&gt;</dc:contributor>
        <dc:contributor>Firas AlShafei &lt;firas.alshafei@us.abb.com&gt;</dc:contributor>
        <dc:contributor>Rodrigo Alvares &lt;ralvares@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Anderson &lt;cba@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>angystardust &lt;angystardust@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>anivan-suse &lt;anastasija.ivanovic@suse.com&gt;</dc:contributor>
        <dc:contributor>anixon-rh &lt;55244503+anixon-rh@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Chuck Atkins &lt;chuck.atkins@kitware.com&gt;</dc:contributor>
        <dc:contributor>Ryan Ballanger &lt;root@rballang-admin-2.fastenal.com&gt;</dc:contributor>
        <dc:contributor>Alex Baranowski &lt;alex@euro-linux.com&gt;</dc:contributor>
        <dc:contributor>Eduardo Barretto &lt;eduardo.barretto@canonical.com&gt;</dc:contributor>
        <dc:contributor>Molly Jo Bault &lt;Molly.Jo.Bault@ballardtech.com&gt;</dc:contributor>
        <dc:contributor>Gabriel Becker &lt;ggasparb@redhat.com&gt;</dc:contributor>
        <dc:contributor>Alexander Bergmann &lt;abergmann@suse.com&gt;</dc:contributor>
        <dc:contributor>Dale Bewley &lt;dale@bewley.net&gt;</dc:contributor>
        <dc:contributor>Jose Luis BG &lt;bgjoseluis@gmail.com&gt;</dc:contributor>
        <dc:contributor>Joseph Bisch &lt;joseph.bisch@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jeffrey Blank &lt;blank@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Olivier Bonhomme &lt;ptitoliv@ptitoliv.net&gt;</dc:contributor>
        <dc:contributor>Lance Bragstad &lt;lbragstad@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ted Brunell &lt;tbrunell@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Burghardt &lt;marcus@mbsec.com.br&gt;</dc:contributor>
        <dc:contributor>Matthew Burket &lt;mburket@redhat.com&gt;</dc:contributor>
        <dc:contributor>Blake Burkhart &lt;blake.burkhart@us.af.mil&gt;</dc:contributor>
        <dc:contributor>Patrick Callahan &lt;pmc@patrickcallahan.com&gt;</dc:contributor>
        <dc:contributor>George Campbell &lt;gcampbell@palantir.com&gt;</dc:contributor>
        <dc:contributor>Nick Carboni &lt;ncarboni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos &lt;64919342+carlosmmatos@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>James Cassell &lt;james.cassell@ll.mit.edu&gt;</dc:contributor>
        <dc:contributor>Frank Caviggia &lt;fcaviggi@ra.iad.redhat.com&gt;</dc:contributor>
        <dc:contributor>Eric Christensen &lt;echriste@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jayson Cofell &lt;1051437+70k10@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Caleb Cooper &lt;coopercd@ornl.gov&gt;</dc:contributor>
        <dc:contributor>Richard Maciel Costa &lt;richard.maciel.costa@canonical.com&gt;</dc:contributor>
        <dc:contributor>Deric Crago &lt;deric.crago@gmail.com&gt;</dc:contributor>
        <dc:contributor>crleekwc &lt;crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>Will Cushen &lt;wcushen@redhat.com&gt;</dc:contributor>
        <dc:contributor>cyarbrough76 &lt;42849651+cyarbrough76@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Maura Dailey &lt;maura@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Klaas Demter &lt;demter@atix.de&gt;</dc:contributor>
        <dc:contributor>dhanushkar-wso2 &lt;dhanushkar@wso2.com&gt;</dc:contributor>
        <dc:contributor>Andrew DiPrinzio &lt;andrew.diprinzio@jhuapl.edu&gt;</dc:contributor>
        <dc:contributor>dom &lt;dominique.blaze@devinci.fr&gt;</dc:contributor>
        <dc:contributor>Jean-Baptiste Donnette &lt;jean-baptiste.donnette@epita.fr&gt;</dc:contributor>
        <dc:contributor>drax &lt;applezip@gmail.com&gt;</dc:contributor>
        <dc:contributor>Sebastian Dunne &lt;sdunne@redhat.com&gt;</dc:contributor>
        <dc:contributor>François Duthilleul &lt;francoisduthilleul@gmail.com&gt;</dc:contributor>
        <dc:contributor>Greg Elin &lt;gregelin@gitmachines.com&gt;</dc:contributor>
        <dc:contributor>eradot4027 &lt;jrtonmac@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alexis Facques &lt;alexis.facques@mythalesgroup.io&gt;</dc:contributor>
        <dc:contributor>Leah Fisher &lt;lfisher047@gmail.com&gt;</dc:contributor>
        <dc:contributor>Yavor Georgiev &lt;strandjata@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alijohn Ghassemlouei &lt;alijohn@secureagc.com&gt;</dc:contributor>
        <dc:contributor>ghylock &lt;ghylock@gmail.com&gt;</dc:contributor>
        <dc:contributor>Andrew Gilmore &lt;agilmore2@gmail.com&gt;</dc:contributor>
        <dc:contributor>Joshua Glemza &lt;jglemza@nasa.gov&gt;</dc:contributor>
        <dc:contributor>Nick Gompper &lt;forestgomp@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Loren Gordon &lt;lorengordon@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Patrik Greco &lt;sikevux@sikevux.se&gt;</dc:contributor>
        <dc:contributor>Steve Grubb &lt;sgrubb@redhat.com&gt;</dc:contributor>
        <dc:contributor>guangyee &lt;gyee@suse.com&gt;</dc:contributor>
        <dc:contributor>Marek Haicman &lt;mhaicman@redhat.com&gt;</dc:contributor>
        <dc:contributor>Vern Hart &lt;vern.hart@canonical.com&gt;</dc:contributor>
        <dc:contributor>Alex Haydock &lt;alex@alexhaydock.co.uk&gt;</dc:contributor>
        <dc:contributor>Rebekah Hayes &lt;rhayes@corp.rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Trey Henefield &lt;thenefield@gmail.com&gt;</dc:contributor>
        <dc:contributor>Henning Henkel &lt;henning.henkel@helvetia.ch&gt;</dc:contributor>
        <dc:contributor>hex2a &lt;hex2a@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>John Hooks &lt;jhooks@starscream.pa.jhbcomputers.com&gt;</dc:contributor>
        <dc:contributor>Jakub Hrozek &lt;jhrozek@redhat.com&gt;</dc:contributor>
        <dc:contributor>De Huo &lt;De.Huo@windriver.com&gt;</dc:contributor>
        <dc:contributor>Robin Price II &lt;robin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Yasir Imam &lt;yimam@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jiri Jaburek &lt;jjaburek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Keith Jackson &lt;keithkjackson@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jeremiah Jahn &lt;jeremiah@goodinassociates.com&gt;</dc:contributor>
        <dc:contributor>Jakub Jelen &lt;jjelen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jessicahfy &lt;Jessicahfy@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Stephan Joerrens &lt;Stephan.Joerrens@fiduciagad.de&gt;</dc:contributor>
        <dc:contributor>Jono &lt;jono@ubuntu-18.localdomain&gt;</dc:contributor>
        <dc:contributor>Kai Kang &lt;kai.kang@windriver.com&gt;</dc:contributor>
        <dc:contributor>Charles Kernstock &lt;charles.kernstock@ultra-ats.com&gt;</dc:contributor>
        <dc:contributor>Yuli Khodorkovskiy &lt;ykhodorkovskiy@tresys.com&gt;</dc:contributor>
        <dc:contributor>Nathan Kinder &lt;nkinder@redhat.com&gt;</dc:contributor>
        <dc:contributor>Lee Kinser &lt;lee.kinser@gmail.com&gt;</dc:contributor>
        <dc:contributor>Evgeny Kolesnikov &lt;ekolesni@redhat.com&gt;</dc:contributor>
        <dc:contributor>Peter 'Pessoft' Kolínek &lt;github@pessoft.com&gt;</dc:contributor>
        <dc:contributor>Luke Kordell &lt;luke.t.kordell@lmco.com&gt;</dc:contributor>
        <dc:contributor>Malte Kraus &lt;malte.kraus@suse.com&gt;</dc:contributor>
        <dc:contributor>Seth Kress &lt;seth.kress@dsainc.com&gt;</dc:contributor>
        <dc:contributor>kspargur &lt;kspargur@kspargur.csb&gt;</dc:contributor>
        <dc:contributor>Amit Kumar &lt;amitkuma@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fen Labalme &lt;fen@civicactions.com&gt;</dc:contributor>
        <dc:contributor>Ade Lee &lt;alee@redhat.com&gt;</dc:contributor>
        <dc:contributor>Christopher Lee &lt;Crleekwc@gmail.com&gt;</dc:contributor>
        <dc:contributor>Ian Lee &lt;lee1001@llnl.gov&gt;</dc:contributor>
        <dc:contributor>Jarrett Lee &lt;jarrettl@umd.edu&gt;</dc:contributor>
        <dc:contributor>Joseph Lenox &lt;lordofhyphens@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jan Lieskovsky &lt;jlieskov@redhat.com&gt;</dc:contributor>
        <dc:contributor>Šimon Lukašík &lt;slukasik@redhat.com&gt;</dc:contributor>
        <dc:contributor>Milan Lysonek &lt;mlysonek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Fredrik Lysén &lt;fredrik@pipemore.se&gt;</dc:contributor>
        <dc:contributor>Caitlin Macleod &lt;caitelatte@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nick Maludy &lt;nmaludy@gmail.com&gt;</dc:contributor>
        <dc:contributor>Lokesh Mandvekar &lt;lsm5@fedoraproject.org&gt;</dc:contributor>
        <dc:contributor>Matus Marhefka &lt;mmarhefk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jamie Lorwey Martin &lt;jlmartin@redhat.com&gt;</dc:contributor>
        <dc:contributor>Carlos Matos &lt;cmatos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Robert McAllister &lt;rmcallis@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michael McConachie &lt;michael@redhat.com&gt;</dc:contributor>
        <dc:contributor>Marcus Meissner &lt;meissner@suse.de&gt;</dc:contributor>
        <dc:contributor>Khary Mendez &lt;kmendez@redhat.com&gt;</dc:contributor>
        <dc:contributor>Rodney Mercer &lt;rmercer@harris.com&gt;</dc:contributor>
        <dc:contributor>Matt Micene &lt;nzwulfin@gmail.com&gt;</dc:contributor>
        <dc:contributor>Brian Millett &lt;bmillett@gmail.com&gt;</dc:contributor>
        <dc:contributor>Takuya Mishina &lt;tmishina@jp.ibm.com&gt;</dc:contributor>
        <dc:contributor>Mixer9 &lt;35545791+Mixer9@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>mmosel &lt;mmosel@kde.example.com&gt;</dc:contributor>
        <dc:contributor>Zbynek Moravec &lt;zmoravec@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kazuo Moriwaka &lt;moriwaka@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Michael Moseley &lt;michael@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Renaud Métrich &lt;rmetrich@redhat.com&gt;</dc:contributor>
        <dc:contributor>Joe Nall &lt;joe@nall.com&gt;</dc:contributor>
        <dc:contributor>Neiloy &lt;neiloy@redhat.com&gt;</dc:contributor>
        <dc:contributor>Axel Nennker &lt;axel@nennker.de&gt;</dc:contributor>
        <dc:contributor>Michele Newman &lt;mnewman@redhat.com&gt;</dc:contributor>
        <dc:contributor>Sean O'Keeffe &lt;seanokeeffe797@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jiri Odehnal &lt;jodehnal@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ilya Okomin &lt;ilya.okomin@oracle.com&gt;</dc:contributor>
        <dc:contributor>Kaustubh Padegaonkar &lt;theTuxRacer@gmail.com&gt;</dc:contributor>
        <dc:contributor>Michael Palmiotto &lt;mpalmiotto@tresys.com&gt;</dc:contributor>
        <dc:contributor>Eryx Paredes &lt;eryxp@lyft.com&gt;</dc:contributor>
        <dc:contributor>Max R.D. Parmer &lt;maxp@trystero.is&gt;</dc:contributor>
        <dc:contributor>Arnaud Patard &lt;apatard@hupstream.com&gt;</dc:contributor>
        <dc:contributor>Jan Pazdziora &lt;jpazdziora@redhat.com&gt;</dc:contributor>
        <dc:contributor>pcactr &lt;paul.c.arnold4.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Kenneth Peeples &lt;kennethwpeeples@gmail.com&gt;</dc:contributor>
        <dc:contributor>Nathan Peters &lt;Nathaniel.Peters@ca.com&gt;</dc:contributor>
        <dc:contributor>Frank Lin PIAT &lt;fpiat@klabs.be&gt;</dc:contributor>
        <dc:contributor>Stefan Pietsch &lt;mail.ipv4v6+gh@gmail.com&gt;</dc:contributor>
        <dc:contributor>piggyvenus &lt;piggyvenus@gmail.com&gt;</dc:contributor>
        <dc:contributor>Vojtech Polasek &lt;vpolasek@redhat.com&gt;</dc:contributor>
        <dc:contributor>Orion Poplawski &lt;orion@nwra.com&gt;</dc:contributor>
        <dc:contributor>Nick Poyant &lt;npoyant@redhat.com&gt;</dc:contributor>
        <dc:contributor>Martin Preisler &lt;mpreisle@redhat.com&gt;</dc:contributor>
        <dc:contributor>Wesley Ceraso Prudencio &lt;wcerasop@redhat.com&gt;</dc:contributor>
        <dc:contributor>Raphael Sanchez Prudencio &lt;rsprudencio@redhat.com&gt;</dc:contributor>
        <dc:contributor>T.O. Radzy Radzykewycz &lt;radzy@windriver.com&gt;</dc:contributor>
        <dc:contributor>Kenyon Ralph &lt;kenyon@kenyonralph.com&gt;</dc:contributor>
        <dc:contributor>Mike Ralph &lt;mralph@redhat.com&gt;</dc:contributor>
        <dc:contributor>Federico Ramirez &lt;federico.r.ramirez@oracle.com&gt;</dc:contributor>
        <dc:contributor>rchikov &lt;rumen.chikov@suse.com&gt;</dc:contributor>
        <dc:contributor>Rick Renshaw &lt;Richard_Renshaw@xtoenergy.com&gt;</dc:contributor>
        <dc:contributor>Chris Reynolds &lt;c.reynolds82@gmail.com&gt;</dc:contributor>
        <dc:contributor>rhayes &lt;rhayes@rivierautilities.com&gt;</dc:contributor>
        <dc:contributor>Pat Riehecky &lt;riehecky@fnal.gov&gt;</dc:contributor>
        <dc:contributor>rlucente-se-jboss &lt;rlucente@redhat.com&gt;</dc:contributor>
        <dc:contributor>Juan Antonio Osorio Robles &lt;jaosorior@redhat.com&gt;</dc:contributor>
        <dc:contributor>Juan Osorio Robles &lt;jaosorior@gmail.com&gt;</dc:contributor>
        <dc:contributor>Matt Rogers &lt;mrogers@redhat.com&gt;</dc:contributor>
        <dc:contributor>Jesse Roland &lt;jesse.roland@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Joshua Roys &lt;roysjosh@gmail.com&gt;</dc:contributor>
        <dc:contributor>rrenshaw &lt;bofh69@yahoo.com&gt;</dc:contributor>
        <dc:contributor>Chris Ruffalo &lt;chris.ruffalo@gmail.com&gt;</dc:contributor>
        <dc:contributor>rumch-se &lt;77793453+rumch-se@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Ray Shaw (Cont ARL/CISD) rvshaw &lt;rvshaw@esme.arl.army.mil&gt;</dc:contributor>
        <dc:contributor>Earl Sampson &lt;ESampson@suse.com&gt;</dc:contributor>
        <dc:contributor>sampsone &lt;esampson@suse.com&gt;</dc:contributor>
        <dc:contributor>Willy Santos &lt;wsantos@redhat.com&gt;</dc:contributor>
        <dc:contributor>Gautam Satish &lt;gautams@hpe.com&gt;</dc:contributor>
        <dc:contributor>Watson Sato &lt;wsato@redhat.com&gt;</dc:contributor>
        <dc:contributor>Satoru SATOH &lt;satoru.satoh@gmail.com&gt;</dc:contributor>
        <dc:contributor>Alexander Scheel &lt;ascheel@redhat.com&gt;</dc:contributor>
        <dc:contributor>Bryan Schneiders &lt;pschneiders@trisept.com&gt;</dc:contributor>
        <dc:contributor>shaneboulden &lt;shane.boulden@gmail.com&gt;</dc:contributor>
        <dc:contributor>Spencer Shimko &lt;sshimko@tresys.com&gt;</dc:contributor>
        <dc:contributor>Mark Shoger &lt;mshoger@redhat.com&gt;</dc:contributor>
        <dc:contributor>Thomas Sjögren &lt;konstruktoid@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Francisco Slavin &lt;fslavin@tresys.com&gt;</dc:contributor>
        <dc:contributor>David Smith &lt;dsmith@eclipse.ncsc.mil&gt;</dc:contributor>
        <dc:contributor>Kevin Spargur &lt;kspargur@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kenneth Stailey &lt;kstailey.lists@gmail.com&gt;</dc:contributor>
        <dc:contributor>Leland Steinke &lt;leland.j.steinke.ctr@mail.mil&gt;</dc:contributor>
        <dc:contributor>Justin Stephenson &lt;jstephen@redhat.com&gt;</dc:contributor>
        <dc:contributor>Brian Stinson &lt;brian@bstinson.com&gt;</dc:contributor>
        <dc:contributor>Jake Stookey &lt;jakestookey@gmail.com&gt;</dc:contributor>
        <dc:contributor>Jonathan Sturges &lt;jsturges@redhat.com&gt;</dc:contributor>
        <dc:contributor>Ian Tewksbury &lt;itewk@redhat.com&gt;</dc:contributor>
        <dc:contributor>Philippe Thierry &lt;phil@reseau-libre.net&gt;</dc:contributor>
        <dc:contributor>Derek Thurston &lt;thegrit@gmail.com&gt;</dc:contributor>
        <dc:contributor>tianzhenjia &lt;jiatianzhen@cmss.chinamobile.com&gt;</dc:contributor>
        <dc:contributor>Greg Tinsley &lt;gtinsley@redhat.com&gt;</dc:contributor>
        <dc:contributor>Paul Tittle &lt;ptittle@cmf.nrl.navy.mil&gt;</dc:contributor>
        <dc:contributor>tom &lt;tom@localhost.localdomain&gt;</dc:contributor>
        <dc:contributor>tomas.hudik &lt;tomas.hudik@embedit.cz&gt;</dc:contributor>
        <dc:contributor>Jeb Trayer &lt;jeb.d.trayer@uscg.mil&gt;</dc:contributor>
        <dc:contributor>Viktors Trubovics &lt;viktors.trubovics@suse.com&gt;</dc:contributor>
        <dc:contributor>Nico Truzzolino &lt;nico.truzzolino@gmx.de&gt;</dc:contributor>
        <dc:contributor>Brian Turek &lt;brian.turek@gmail.com&gt;</dc:contributor>
        <dc:contributor>Matěj Týč &lt;matyc@redhat.com&gt;</dc:contributor>
        <dc:contributor>VadimDor &lt;29509093+VadimDor@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Trevor Vaughan &lt;tvaughan@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>vtrubovics &lt;82443408+vtrubovics@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Samuel Warren &lt;swarren@redhat.com&gt;</dc:contributor>
        <dc:contributor>wcushen &lt;54533890+wcushen@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Shawn Wells &lt;shawn@shawndwells.io&gt;</dc:contributor>
        <dc:contributor>Daniel E. White &lt;linuxdan@users.noreply.github.com&gt;</dc:contributor>
        <dc:contributor>Bernhard M. Wiedemann &lt;bwiedemann@suse.de&gt;</dc:contributor>
        <dc:contributor>Roy Williams &lt;roywilli@roywilli.redhat.com&gt;</dc:contributor>
        <dc:contributor>Willumpie &lt;willumpie@xs4all.nl&gt;</dc:contributor>
        <dc:contributor>Rob Wilmoth &lt;rwilmoth@redhat.com&gt;</dc:contributor>
        <dc:contributor>Lucas Yamanishi &lt;lucas.yamanishi@onyxpoint.com&gt;</dc:contributor>
        <dc:contributor>Xirui Yang &lt;xirui.yang@oracle.com&gt;</dc:contributor>
        <dc:contributor>yarunachalam &lt;yarunachalam@suse.com&gt;</dc:contributor>
        <dc:contributor>Guang Yee &lt;guang.yee@suse.com&gt;</dc:contributor>
        <dc:contributor>Achilleas John Yfantis &lt;ayfantis@redhat.com&gt;</dc:contributor>
        <dc:contributor>Kevin Zimmerman &lt;kevin.zimmerman@kitware.com&gt;</dc:contributor>
        <dc:contributor>Jan Černý &lt;jcerny@redhat.com&gt;</dc:contributor>
        <dc:contributor>Michal Šrubař &lt;msrubar@redhat.com&gt;</dc:contributor>
        <dc:source>https://github.com/ComplianceAsCode/content/releases/latest</dc:source>
      </xccdf-1.2:metadata>
      <xccdf-1.2:model system="urn:xccdf:scoring:default"/>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_ospp">
        <xccdf-1.2:title xml:lang="en-US" override="true">OSPP - Protection Profile for General Purpose Operating Systems</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US" override="true">This profile reflects mandatory configuration controls identified in the
NIAP Configuration Annex to the Protection Profile for General Purpose
Operating Systems (Protection Profile Version 4.2).

As Fedora OS is moving target, this profile does not guarantee to provide
security levels required from US National Security Systems. Main goal of
the profile is to provide Fedora developers with hardened environment
similar to the one mandated by US National Security Systems.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ocredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_retry" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_tmout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_faillock" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_lastlog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events_tallylog" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgidmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newuidmap" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pt_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_usernetctl" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_o_trunc_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat_rule_order" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_freq" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_local_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_log_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_name_format" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_write_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_banner_etc_issue" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_client_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_no_chronyc_network" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_backtraces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_coredump_disable_storage" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_directory_access_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_disable_host_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_apply_updates" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dnf-automatic_security_updates_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_local_packages" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gnome_gdm_disable_guest_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_disable_interactive_boot" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_can_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_abrt_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_fapolicyd_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_screen_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_sendmail_removed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_require_singleuser_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_cron_logging" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_all_devicefiles_labeled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_policytype" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_selinux_state" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_debug-shell_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_rngd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_gssapi_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_kerb_auth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_enable_warning_banner" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_rekey_limit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_run_as_sssd_user" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_core_pattern" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_dmesg_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kexec_load_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_kptr_restrict" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_perf_event_paranoid" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_unprivileged_bpf_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_kernel_yama_ptrace_scope" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_net_core_bpf_jit_harden" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_timer_dnf-automatic_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_aide" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_account_expiration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_time_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" selector="fips"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name" selector="targeted"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_selinux_state" selector="enforcing"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="12"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout" selector="10_min"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" selector="900"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="never"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry" selector="3"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_login_banner_text" selector="usgcb_default"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_pci-dss">
        <xccdf-1.2:title xml:lang="en-US" override="true">PCI-DSS v3.2.1 Control Baseline for Fedora</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US" override="true">Ensures PCI-DSS v3.2.1 related security configuration settings are applied.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_install_hids" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_logins" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-session" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_root_paths" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-firewalld" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_firewalld_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_within_important_dirs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" selector="4"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" selector="6"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" selector="1800"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="15_minutes"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass" selector="2"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" selector="rhel"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" selector="cac"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Profile id="xccdf_org.ssgproject.content_profile_standard">
        <xccdf-1.2:title xml:lang="en-US" override="true">Standard System Security Profile for Fedora</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US" override="true">This profile contains rules to ensure standard security baseline of a Fedora system.
Regardless of your system's workload all of these checks should pass.</xccdf-1.2:description>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_account_unique_name" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_minlen_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_binary_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_file_permissions_library_dirs" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_grub2_nousb_argument" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_direct_root_logins" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_no_netrc_files" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_restrict_serial_port_logins" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_securetty_root_login_console_only" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_auditd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_disable_root_login" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="true"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_remediation_functions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fips" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_certified-vendor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mcafee_hbss_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disk_partitioning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_login_screen" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_media_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_network_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_remote_access_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gnome_system_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sap_host" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sudo" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_system-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-banners" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_gui_login_banner" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_locking_out_password_attempts" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pamcracklib" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_password_quality_pwquality" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_accounts-physical" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_console_screen_locking" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smart_card_login" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_user_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_acl_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_policy_rules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apparmor" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-grub2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_non-uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_uefi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_bootloader-zipl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_entropy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_logging" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_log_rotation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rsyslog_sending_messages" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipsec" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-iptables" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_activation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_icmp_disabled" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_ipv6" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-kernel" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_and_router_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_host_parameters" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-susefirewall2" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-uncommon" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network-wireless" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_wireless_software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_network_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_important_account_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_var_log_dir" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_partitions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_permissions_local" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_coredumps" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_daemon_umask" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_execshield_settings" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_enable_nx" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_poisoning" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_selinux-booleans" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apport" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_apt" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_avahi_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disable_avahi_group" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_base" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_cron_and_at" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_restrict_at_cron_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_deprecated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_client_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dhcp_server_configuration" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dhcp_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dns_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_isolation" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_dedicated" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_protection" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_partition_with_views" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_docker" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_fapolicyd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_restrict_users" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ftp_use_vsftpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_http" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_installing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_securing_httpd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_chroot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_configure_php_securely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_directory_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_core_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_basic_authentication" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_optional_components" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_modules_improve_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_secure_content" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_imap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_dovecot" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_kerberos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_openldap_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mail" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_harden_os" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_cfg" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_dos" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_and_rpc" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_netfs" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfs_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_clients" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_nfsd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_mounting_remote_filesystems" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nfs_configuring_servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_exports_restrictively" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_export_filesystems_read_only" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_obsolete" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_inetd_and_xinetd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_nis" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_r_services" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_talk" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_telnet" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_tftp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configure_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_proxy" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_squid" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_radius" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_rng" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_routing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_quagga" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_configuring_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_disable_printing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_samba" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_snmp_service" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_snmp_configure_server" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_ssh_client" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_sssd-ldap" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_usbguard" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_disabling_xwindows" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_general-principles" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-least-privilege" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-minimize-software" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-separate-servers" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_principle-use-security-tools" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_how-to-use" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-formatting-conventions" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-read-sections-completely" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-reboot-required" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-root-shell-assumed" selected="false"/>
        <xccdf-1.2:select idref="xccdf_org.ssgproject.content_group_intro-test-non-production" selected="false"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" selector="12"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" selector="90"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" selector="7"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" selector="5"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" selector="5_minutes"/>
        <xccdf-1.2:refine-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" selector="1"/>
      </xccdf-1.2:Profile>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_remediation_functions">
        <xccdf-1.2:title xml:lang="en-US">Remediation functions used by the SCAP Security Guide Project</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US">XCCDF form of the various remediation functions as used by remediation scripts from the SCAP Security Guide Project.</xccdf-1.2:description>
        <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_function_populate" hidden="true" prohibitChanges="true" operator="equals" type="string">
          <xccdf-1.2:title xml:lang="en-US">Remediation function populate</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Shared bash remediation function. Not intended to be changed by tailoring.</xccdf-1.2:description>
          <xccdf-1.2:value># The populate function isn't directly used by SSG at the moment but it can be 
# used for testing purposes and will be used in SSG Testsuite in the future.

function populate {
# code to populate environment variables needed (for unit testing)
if [ -z "${!1}" ]; then
	echo "$1 is not defined. Exiting."
	exit
fi
}</xccdf-1.2:value>
        </xccdf-1.2:Value>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system">
        <xccdf-1.2:title xml:lang="en-US">System Settings</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US">Contains rules that check correct system settings.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software">
          <xccdf-1.2:title xml:lang="en-US">Installing and Maintaining Software</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The following sections contain information on
security-relevant choices during the initial operating system
installation process and the setup of software
updates.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_integrity">
            <xccdf-1.2:title xml:lang="en-US">System and Software Integrity</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">System and software integrity can be gained by installing antivirus, increasing
system encryption strength with FIPS, verifying installed software, enabling SELinux,
installing an Intrusion Prevention System, etc. However, installing or enabling integrity
checking tools cannot <html:i>prevent</html:i> intrusions, but they can detect that an intrusion
may have occurred. Requirements for integrity checking may be highly dependent on
the environment in which the system will be used. Snapshot-based approaches such
as AIDE may induce considerable overhead in the presence of frequent software updates.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_software-integrity">
              <xccdf-1.2:title xml:lang="en-US">Software Integrity Checking</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Both the AIDE (Advanced Intrusion Detection Environment)
software and the RPM package management system provide
mechanisms for verifying the integrity of installed software.
AIDE uses snapshots of file metadata (such as hashes) and compares these
to current system files in order to detect changes.
<html:br/><html:br/>
The RPM package management system can conduct integrity
checks by comparing information in its metadata database with
files installed on the system.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email" type="string" interactive="true">
                <xccdf-1.2:title xml:lang="en-US">Integrity Scan Notification Email Address</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the email address for designated personnel if baseline
configurations are changed in an unauthorized manner.</xccdf-1.2:description>
                <xccdf-1.2:value>root@localhost</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rpm_verification">
                <xccdf-1.2:title xml:lang="en-US">Verify Integrity with RPM</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The RPM package management system includes the ability
to verify the integrity of installed packages by comparing the
installed files with information about the files taken from the
package metadata stored in the RPM database. Although an attacker
could corrupt the RPM database (analogous to attacking the AIDE
database as described above), this check can still reveal
modification of important files. To list which files on the system differ from what is expected by the RPM database:
<html:pre>$ rpm -qVa</html:pre>
See the man page for <html:code>rpm</html:code> to see a complete explanation of each column.</xccdf-1.2:description>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" selected="false" role="full" severity="high">
                  <xccdf-1.2:title xml:lang="en-US">Verify File Hashes with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Without cryptographic integrity protections, system
executables and files can be altered by unauthorized users without
detection.
The RPM package management system can check the hashes of
installed software packages, including many that are important to system
security.
To verify that the cryptographic hash of system files and commands matches vendor
values, run the following command to list which files on the system
have hashes that differ from what is expected by the RPM database:
<html:pre>$ rpm -Va --noconfig | grep '^..5'</html:pre>
A "c" in the second column indicates that a file is a configuration file, which
may appropriately be expected to change. If the file was not expected to
change, investigate the cause of the change using audit logs or other means.
The package can then be reinstalled to restore the file.
Run the following command to determine which package owns the file:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i></html:pre>
The package can be reinstalled from a dnf repository using the command:
<html:pre>$ sudo dnf reinstall <html:i>PACKAGENAME</html:i></html:pre>
Alternatively, the package can be reinstalled from trusted media using the command:
<html:pre>$ sudo rpm -Uvh <html:i>PACKAGENAME</html:i></html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">The hashes of important files like system executables should match the
information given by the RPM database. Executables with erroneous hashes could
be a sign of nefarious activity on the system.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix id="rpm_verify_hashes" system="urn:xccdf:fix:script:sh">
# Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names
files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )"

# From files names get package names and change newline to space, because rpm writes each package to new line
packages_to_reinstall="$(rpm -qf $files_with_incorrect_hash | tr '\n' ' ')"

dnf reinstall -y $packages_to_reinstall
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="rpm_verify_hashes" system="urn:xccdf:fix:script:ansible" complexity="high" disruption="medium" strategy="restrict">- name: 'Set fact: Package manager reinstall command (dnf)'
  set_fact:
    package_manager_reinstall_cmd: dnf reinstall -y
  when: ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: 'Set fact: Package manager reinstall command (yum)'
  set_fact:
    package_manager_reinstall_cmd: yum reinstall -y
  when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux")
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Read files with incorrect hash
  command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser
    --nogroup --nomode --noghost --noconfig
  args:
    warn: false
  register: files_with_incorrect_hash
  changed_when: false
  failed_when: files_with_incorrect_hash.rc &gt; 1
  check_mode: false
  when: (package_manager_reinstall_cmd is defined)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_hash.stdout_lines | map(''regex_findall'',
    ''^[.]+[5]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (files_with_incorrect_hash.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes

- name: Reinstall packages of files with incorrect hash
  command: '{{ package_manager_reinstall_cmd }} ''{{ item }}'''
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when:
    - files_with_incorrect_hash.stdout_lines is defined
    - (package_manager_reinstall_cmd is defined and (files_with_incorrect_hash.stdout_lines
      | length &gt; 0))
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_hashes
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-rpm_verify_hashes:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" selected="false" role="full" severity="high">
                  <xccdf-1.2:title xml:lang="en-US">Verify and Correct File Permissions with RPM</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The RPM package management system can check file access permissions
of installed software packages, including many that are important
to system security.
Verify that the file permissions of system files
and commands match vendor values. Check the file permissions
with the following command:
<html:pre>$ sudo rpm -Va | awk '{ if (substr($0,2,1)=="M") print $NF }'</html:pre>
Output indicates files that do not match vendor defaults.
After locating a file with incorrect permissions,
run the following command to determine which package owns it:
<html:pre>$ rpm -qf <html:i>FILENAME</html:i></html:pre>
<html:br/>
Next, run the following command to reset its permissions to
the correct values:
<html:pre>$ sudo rpm --setperms <html:i>PACKAGENAME</html:i></html:pre></xccdf-1.2:description>
                  <xccdf-1.2:warning xml:lang="en-US" category="general">Profiles may require that specific files have stricter file permissions than defined by the
vendor.
Such files will be reported as a finding and need to be evaluated according to your policy
and deployment environment.</xccdf-1.2:warning>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001493</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001494</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001495</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001496</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(d)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000256-GPOS-00097</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000257-GPOS-00098</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000258-GPOS-00099</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000278-GPOS-00108</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Permissions on system binaries and configuration files that are too generous
could allow an unauthorized user to gain privileges that they should not have.
The permissions set by the vendor should be maintained. Any deviations from
this baseline should be investigated.</xccdf-1.2:rationale>
                  <xccdf-1.2:fix id="rpm_verify_permissions" system="urn:xccdf:fix:script:sh" complexity="high" disruption="medium" strategy="restrict">
# Declare array to hold set of RPM packages we need to correct permissions for
declare -A SETPERMS_RPM_DICT

# Create a list of files on the system having permissions different from what
# is expected by the RPM database
readarray -t FILES_WITH_INCORRECT_PERMS &lt; &lt;(rpm -Va --nofiledigest | awk '{ if (substr($0,2,1)=="M") print $NF }')

for FILE_PATH in "${FILES_WITH_INCORRECT_PERMS[@]}"
do
        # NOTE: some files maybe controlled by more then one package
        readarray -t RPM_PACKAGES &lt; &lt;(rpm -qf "${FILE_PATH}")
        for RPM_PACKAGE in "${RPM_PACKAGES[@]}"
        do
                # Use an associative array to store packages as it's keys, not having to care about duplicates.
                SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1
        done
done

# For each of the RPM packages left in the list -- reset its permissions to the
# correct values
for RPM_PACKAGE in "${!SETPERMS_RPM_DICT[@]}"
do
	rpm --restore "${RPM_PACKAGE}"
done
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="rpm_verify_permissions" system="urn:xccdf:fix:script:ansible" complexity="high" disruption="medium" strategy="restrict">- name: Read list of files with incorrect permissions
  command: rpm -Va --nodeps --nosignature --nofiledigest --nosize --nomtime --nordev
    --nocaps --nolinkto --nouser --nogroup
  args:
    warn: false
  register: files_with_incorrect_permissions
  failed_when: files_with_incorrect_permissions.rc &gt; 1
  changed_when: false
  check_mode: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Create list of packages
  command: rpm -qf "{{ item }}"
  args:
    warn: false
  with_items: '{{ files_with_incorrect_permissions.stdout_lines | map(''regex_findall'',
    ''^[.]+[M]+.* (\/.*)'', ''\1'') | map(''join'') | select(''match'', ''(\/.*)'')
    | list | unique }}'
  register: list_of_packages
  changed_when: false
  check_mode: false
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions

- name: Correct file permissions with RPM
  command: rpm --setperms '{{ item }}'
  args:
    warn: false
  with_items: '{{ list_of_packages.results | map(attribute=''stdout_lines'') | list
    | unique }}'
  when: (files_with_incorrect_permissions.stdout_lines | length &gt; 0)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.3.8
    - NIST-800-171-3.4.1
    - NIST-800-53-AU-9(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(c)
    - NIST-800-53-CM-6(d)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - NIST-800-53-SI-7(6)
    - PCI-DSS-Req-11.5
    - high_complexity
    - high_severity
    - medium_disruption
    - no_reboot_needed
    - restrict_strategy
    - rpm_verify_permissions
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-rpm_verify_permissions:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_aide">
                <xccdf-1.2:title xml:lang="en-US">Verify Integrity with AIDE</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">AIDE conducts integrity checks by comparing information about
files with previously-gathered information. Ideally, the AIDE database is
created immediately after initial system configuration, and then again after any
software update.  AIDE is highly configurable, with further configuration
information located in <html:code>/usr/share/doc/aide-<html:i>VERSION</html:i></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Install AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The <html:code>aide</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install aide</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1034</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1288</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1341</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1417</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">The AIDE package must be installed if it is to be available for integrity checking.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="package_aide_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_aide_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure aide is installed
  package:
    name: aide
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_aide_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_aide_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_aide

class install_aide {
  package { 'aide':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_aide_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=aide
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_aide_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "aide"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-package_aide_installed:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-package_aide_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Build and Test AIDE Database</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Run the following command to generate a new database:
<html:pre>$ sudo /usr/sbin/aide --init</html:pre>
By default, the database will be written to the file <html:code>/var/lib/aide/aide.db.new.gz</html:code>.
Storing the database, the configuration file <html:code>/etc/aide.conf</html:code>, and the binary
<html:code>/usr/sbin/aide</html:code> (or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:

<html:pre>$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz</html:pre>

To initiate a manual check, run the following command:
<html:pre>$ sudo /usr/sbin/aide --check</html:pre>
If this check produces any unexpected output, investigate.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="aide_build_database" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

/usr/sbin/aide --init
/bin/cp -p /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="aide_build_database" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Build and Test AIDE Database
  command: /usr/sbin/aide --init
  changed_when: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check whether the stock AIDE Database exists
  stat:
    path: /var/lib/aide/aide.db.new.gz
  register: aide_database_stat
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Stage AIDE Database
  copy:
    src: /var/lib/aide/aide.db.new.gz
    dest: /var/lib/aide/aide.db.gz
    backup: true
    remote_src: true
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - (aide_database_stat.stat.exists is defined and aide_database_stat.stat.exists)
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-11.5
    - aide_build_database
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-aide_build_database:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-aide_build_database_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Configure Periodic Execution of AIDE</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * * root  --check</html:pre>
To implement a weekly execution of AIDE at 4:05am using cron, add the following line to <html:code>/etc/crontab</html:code>:
<html:pre>05 4 * * 0 root  --check</html:pre>
AIDE can be executed periodically through other means; this is merely one example.
The usage of cron's special time codes, such as  <html:code>@daily</html:code> and
<html:code>@weekly</html:code> is acceptable.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R51)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI01.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI02.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS04.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.06</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001744</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002699</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002702</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000363-GPOS-00150</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000446-GPOS-00200</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000447-GPOS-00201</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
<html:br/><html:br/>
Unauthorized changes to the baseline configuration could make the system vulnerable
to various attacks or allow unauthorized access to the operating system. Changes to
operating system configurations can have unintended side effects, some of which may
be relevant to security.
<html:br/><html:br/>
Detecting such changes and providing an automated response can help avoid unintended,
negative consequences that could ultimately affect the security state of the operating
system. The operating system's Information Management Officer (IMO)/Information System
Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or
monitoring system trap when there is an unauthorized modification of a configuration item.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "aide" ; then
    dnf install -y "aide"
fi

if ! grep -q "/usr/sbin/aide --check" /etc/crontab ; then
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
else
    sed -i '\!^.* --check.*$!d' /etc/crontab
    echo "05 4 * * * root /usr/sbin/aide --check" &gt;&gt; /etc/crontab
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="aide_periodic_cron_checking" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Ensure AIDE is installed
  package:
    name: '{{ item }}'
    state: present
  with_items:
    - aide
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set cron package name - RedHat
  set_fact:
    cron_pkg_name: cronie
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_os_family == "RedHat" or ansible_os_family == "Suse"
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set cron package name - Debian
  set_fact:
    cron_pkg_name: cron
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_os_family == "Debian"
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Install cron
  package:
    name: '{{ cron_pkg_name }}'
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Configure Periodic Execution of AIDE
  cron:
    name: run AIDE check
    minute: 5
    hour: 4
    weekday: 0
    user: root
    job: /usr/sbin/aide --check
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.10.1.3
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-7
    - NIST-800-53-SI-7(1)
    - PCI-DSS-Req-11.5
    - aide_periodic_cron_checking
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-aide_periodic_cron_checking:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fips">
              <xccdf-1.2:title xml:lang="en-US">Federal Information Processing Standard (FIPS)</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The Federal Information Processing Standard (FIPS) is a computer security standard which
is developed by the U.S. Government and industry working groups to validate the quality
of cryptographic modules. The FIPS standard provides four security levels to ensure
adequate coverage of different industries, implementation of cryptographic modules, and
organizational sizes and requirements.
<html:br/><html:br/>
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules
utilize authentication that meets industry and government requirements. For government systems, this allows
Security Levels 1, 2, 3, or 4 for use on Fedora.
<html:br/><html:br/>
See <html:b><html:a href="http://csrc.nist.gov/publications/PubsFIPS.html">http://csrc.nist.gov/publications/PubsFIPS.html</html:a></html:b> for more information.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_crypto">
              <xccdf-1.2:title xml:lang="en-US">System Cryptographic Policies</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Linux has the capability to centrally configure cryptographic polices. The command
<html:code>update-crypto-policies</html:code> is used to set the policy applicable for the various
cryptographic back-ends, such as SSL/TLS libraries. The configured cryptographic
policies will be the default policy used by these backends unless the application
user configures them otherwise. When the system has been configured to use the
centralized cryptographic policies, the administrator is assured that any application
that utilizes the supported backends will follow a policy that adheres to the
configured profile.

Currently the supported backends are:
<html:ul><html:li>GnuTLS library</html:li><html:li>OpenSSL library</html:li><html:li>NSS library</html:li><html:li>OpenJDK</html:li><html:li>Libkrb5</html:li><html:li>BIND</html:li><html:li>OpenSSH</html:li></html:ul>
Applications and languages which rely on any of these backends will follow the
system policies as well. Examples are apache httpd, nginx, php, and others.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size" type="string" interactive="true">
                <xccdf-1.2:title xml:lang="en-US">SSH client RekeyLimit - size</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the size component of the rekey limit. This limit signifies amount
of data. After this amount of data is transferred through the connection,
the session key is renegotiated. The number is followed by K, M or G for
kilobytes, megabytes or gigabytes. Note that the RekeyLimit can be also
configured according to elapsed time.</xccdf-1.2:description>
                <xccdf-1.2:value>512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
                <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time" type="string" interactive="true">
                <xccdf-1.2:title xml:lang="en-US">SSH client RekeyLimit - time</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the time component of the rekey limit. The session key is
renegotiated after the defined amount of time passes. The number is followed
by units such as H or M for hours or minutes. Note that the RekeyLimit can
be also configured according to amount of transfered data.</xccdf-1.2:description>
                <xccdf-1.2:value>1h</xccdf-1.2:value>
                <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_system_crypto_policy" type="string">
                <xccdf-1.2:title xml:lang="en-US">The system-provided crypto policies</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the crypto policy for the system.</xccdf-1.2:description>
                <xccdf-1.2:value>DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_policy">DEFAULT</xccdf-1.2:value>
                <xccdf-1.2:value selector="default_nosha1">DEFAULT:NO-SHA1</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips">FIPS</xccdf-1.2:value>
                <xccdf-1.2:value selector="fips_ospp">FIPS:OSPP</xccdf-1.2:value>
                <xccdf-1.2:value selector="legacy">LEGACY</xccdf-1.2:value>
                <xccdf-1.2:value selector="future">FUTURE</xccdf-1.2:value>
                <xccdf-1.2:value selector="next">NEXT</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Configure BIND to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
BIND is supported by crypto policy, but the BIND configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/named.conf</html:code>
includes the appropriate configuration:
In the <html:code>options</html:code> section of <html:code>/etc/named.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include "/etc/crypto-policies/back-ends/bind.config";</html:code></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000423-GPOS-00187</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000426-GPOS-00190</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Overriding the system crypto policy makes the behavior of the BIND service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_bind_crypto_policy" system="urn:xccdf:fix:script:sh">
function remediate_bind_crypto_policy() {
	CONFIG_FILE="/etc/named.conf"
	if test -f "$CONFIG_FILE"; then
		sed -i 's|options {|&amp;\n\tinclude "/etc/crypto-policies/back-ends/bind.config";|' "$CONFIG_FILE"
		return 0
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_bind_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_bind_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_crypto_policy" selected="false" role="full" severity="high">
                <xccdf-1.2:title xml:lang="en-US">Configure System Cryptography Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To configure the system cryptography policy to use ciphers only from the <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:code>
policy, run the following command:
<html:pre>$ sudo update-crypto-policies --set <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/></html:pre>
The rule checks if settings for selected crypto policy are configured as expected. Configuration files in the <html:code>/etc/crypto-policies/back-ends</html:code> are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon.</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">The system needs to be rebooted for these changes to take effect.</xccdf-1.2:warning>
                <xccdf-1.2:warning xml:lang="en-US" category="regulatory">System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See <html:b><html:a href="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf">https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf</html:a></html:b>
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1446</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_COP.1(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_CKM.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_crypto_policy" system="urn:xccdf:fix:script:sh">
# include remediation functions library

var_system_crypto_policy="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>"



stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2&gt;&amp;1 &gt; /dev/null)
rc=$?

if test "$rc" = 127; then
	echo "$stderr_of_call" &gt;&amp;2
	echo "Make sure that the script is installed on the remediated system." &gt;&amp;2
	echo "See output of the 'dnf provides update-crypto-policies' command" &gt;&amp;2
	echo "to see what package to (re)install" &gt;&amp;2

	false  # end with an error code
elif test "$rc" != 0; then
	echo "Error invoking the update-crypto-policies script: $stderr_of_call" &gt;&amp;2
	false  # end with an error code
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="configure_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_system_crypto_policy # promote to variable
  set_fact:
    var_system_crypto_policy: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy" use="legacy"/>
  tags:
    - always

- name: Configure System Cryptography Policy
  lineinfile:
    path: /etc/crypto-policies/config
    regexp: ^(?!#)(\S+)$
    line: '{{ var_system_crypto_policy }}'
    create: true
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy

- name: Verify that Crypto Policy is Set (runtime)
  command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_crypto_policy
    - high_severity
    - low_complexity
    - low_disruption
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Configure Kerberos to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Kerberos is supported by crypto policy, but it's configuration may be
set up to ignore it.
To check that Crypto Policies settings for Kerberos are configured correctly, examine that there is a symlink at
/etc/krb5.conf.d/crypto-policies targeting /etc/cypto-policies/back-ends/krb5.config.
If the symlink exists, kerberos is configured to use the system-wide crypto policy settings.</xccdf-1.2:description>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Overriding the system crypto policy makes the behavior of Kerberos violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_kerberos_crypto_policy" system="urn:xccdf:fix:script:sh" reboot="true" complexity="low" disruption="low" strategy="configure">
rm -f /etc/krb5.conf.d/crypto-policies
ln -s /etc/crypto-policies/back-ends/krb5.config /etc/krb5.conf.d/crypto-policies
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="configure_kerberos_crypto_policy" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="configure">- name: Configure Kerberos to use System Crypto Policy
  file:
    src: /etc/crypto-policies/back-ends/krb5.config
    path: /etc/krb5.conf.d/crypto-policies
    state: link
  tags:
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_kerberos_crypto_policy
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_kerberos_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_kerberos_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Configure Libreswan to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
Libreswan is supported by system crypto policy, but the Libreswan configuration may be
set up to ignore it.

To check that Crypto Policies settings are configured correctly, ensure that the <html:code>/etc/ipsec.conf</html:code>
includes the appropriate configuration file.
In <html:code>/etc/ipsec.conf</html:code>, make sure that the following line
is not commented out or superseded by later includes:
<html:code>include /etc/crypto-policies/back-ends/libreswan.config</html:code></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_IPSEC_EXT.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000033-GPOS-00014</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Overriding the system crypto policy makes the behavior of the Libreswan
service violate expectations, and makes system configuration more
fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_libreswan_crypto_policy" system="urn:xccdf:fix:script:sh">
function remediate_libreswan_crypto_policy() {
    CONFIG_FILE="/etc/ipsec.conf"
    if ! grep -qP "^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$" "$CONFIG_FILE" ; then
        echo 'include /etc/crypto-policies/back-ends/libreswan.config' &gt;&gt; "$CONFIG_FILE"
    fi
    return 0
}

remediate_libreswan_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="configure_libreswan_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Configure Libreswan to use System Crypto Policy
  lineinfile:
    path: /etc/ipsec.conf
    line: include /etc/crypto-policies/back-ends/libreswan.config
    create: true
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_libreswan_crypto_policy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_libreswan_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_libreswan_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Configure OpenSSL library to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
OpenSSL is supported by crypto policy, but the OpenSSL configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, you have to examine the OpenSSL config file
available under <html:code>/etc/pki/tls/openssl.cnf</html:code>.
This file has the <html:code>ini</html:code> format, and it enables crypto policy support
if there is a <html:code>[ crypto_policy ]</html:code> section that contains the <html:code>.include /etc/crypto-policies/back-ends/opensslcnf.config</html:code> directive.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001453</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Overriding the system crypto policy makes the behavior of the Java runtime violates expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_openssl_crypto_policy" system="urn:xccdf:fix:script:sh">
OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config$'

function remediate_openssl_crypto_policy() {
	CONFIG_FILE="/etc/pki/tls/openssl.cnf"
	if test -f "$CONFIG_FILE"; then
		if ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_SECTION_REGEX" "$CONFIG_FILE"; then
			printf '\n%s\n\n%s' "$OPENSSL_CRYPTO_POLICY_SECTION" "$OPENSSL_CRYPTO_POLICY_INCLUSION" &gt;&gt; "$CONFIG_FILE"
			return 0
		elif ! grep -q "^\\s*$OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX" "$CONFIG_FILE"; then
			sed -i "s|$OPENSSL_CRYPTO_POLICY_SECTION_REGEX|&amp;\\n\\n$OPENSSL_CRYPTO_POLICY_INCLUSION\\n|" "$CONFIG_FILE"
			return 0
		fi
	else
		echo "Aborting remediation as '$CONFIG_FILE' was not even found." &gt;&amp;2
		return 1
	fi
}

remediate_openssl_crypto_policy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="configure_openssl_crypto_policy" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Test for crypto_policy group
  command: grep '^\s*\[\s*crypto_policy\s*]' /etc/pki/tls/openssl.cnf
  register: test_crypto_policy_group
  ignore_errors: true
  changed_when: false
  check_mode: false
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add .include for opensslcnf.config to crypto_policy section
  lineinfile:
    create: true
    insertafter: ^\s*\[\s*crypto_policy\s*]\s*
    line: .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &gt; 0
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Add crypto_policy group and set include opensslcnf.config
  lineinfile:
    create: true
    line: |-
      [crypto_policy]
      .include /etc/crypto-policies/back-ends/opensslcnf.config
    path: /etc/pki/tls/openssl.cnf
  when:
    - test_crypto_policy_group.stdout is defined
    - test_crypto_policy_group.stdout | length &lt; 1
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-12(2)
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SC-13
    - configure_openssl_crypto_policy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_openssl_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_openssl_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Configure SSH to use System Crypto Policy</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the <html:code>CRYPTO_POLICY</html:code> variable is either commented or not set at all
in the <html:code>/etc/sysconfig/sshd</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(2)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">MA-4(6)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000250-GPOS-00093</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:sh">
SSH_CONF="/etc/sysconfig/sshd"

sed -i "/^\s*CRYPTO_POLICY.*$/d" $SSH_CONF
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="configure_ssh_crypto_policy" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="medium" strategy="disable">- name: Configure SSH to use System Crypto Policy
  lineinfile:
    dest: /etc/sysconfig/sshd
    state: absent
    regexp: ^\s*CRYPTO_POLICY.*$
  tags:
    - NIST-800-53-AC-17(2)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-MA-4(6)
    - NIST-800-53-SC-13
    - configure_ssh_crypto_policy
    - disable_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - reboot_required
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-configure_ssh_crypto_policy_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_certified-vendor">
              <xccdf-1.2:title xml:lang="en-US">Operating System Vendor Support and Certification</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The assurance of a vendor to provide operating system support and maintenance
for their product is an important criterion to ensure product stability and
security over the life of the product. A certified product that follows the
necessary standards and government certification requirements guarantees that
known software vulnerabilities will be remediated, and proper guidance for
protecting and securing the operating system will be given.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_endpoint_security_software">
              <xccdf-1.2:title xml:lang="en-US">Endpoint Protection Software</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Endpoint protection security software that is not provided or supported

by Red Hat can be installed to provide complementary or duplicative

security capabilities to those provided by the base platform.  Add-on
software may not be appropriate for some specialized systems.</xccdf-1.2:description>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_install_hids" selected="false" role="full" severity="high">
                <xccdf-1.2:title xml:lang="en-US">Install Intrusion Detection Software</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The base Fedora platform already includes a sophisticated auditing system that
can detect intruder activity, as well as SELinux, which provides host-based
intrusion prevention capabilities by confining privileged programs and user
sessions which may become compromised.</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">In DoD environments, supplemental intrusion detection and antivirus tools,
such as the McAfee Host-based Security System, are available to integrate with
existing infrastructure. Per DISA guidance, when these supplemental tools interfere
with proper functioning of SELinux, SELinux takes precedence. Should further
clarification be required, DISA contact information is published publicly at
https://public.cyber.mil/stigs/</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001263</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-11.4</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Host-based intrusion detection tools provide a system-level defense when an
intruder gains access to a system or network.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:conflicts idref="xccdf_org.ssgproject.content_rule_selinux_state"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-install_hids:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-install_hids_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_security_software">
                <xccdf-1.2:title xml:lang="en-US">McAfee Endpoint Security Software</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">In DoD environments, McAfee Host-based Security System (HBSS) and
VirusScan Enterprise for Linux (VSEL) is required to be installed on all systems.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire" type="number">
                  <xccdf-1.2:title xml:lang="en-US">The age of McAfee defintion file before requiring updating</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Specify the amount of time (in seconds) before McAfee definition files need to be
updated.</xccdf-1.2:description>
                  <xccdf-1.2:value>2592000</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1_week">604800</xccdf-1.2:value>
                  <xccdf-1.2:value selector="30_days">2592000</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_endpoint_security_software">
                  <xccdf-1.2:title xml:lang="en-US">McAfee Endpoint Security for Linux (ENSL)</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">McAfee Endpoint Security for Linux (ENSL) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mcafee_hbss_software">
                  <xccdf-1.2:title xml:lang="en-US">McAfee Host-Based Intrusion Detection Software (HBSS)</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">McAfee Host-based Security System (HBSS) is a suite of software applications
used to monitor, detect, and defend computer networks and systems.</xccdf-1.2:description>
                  </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disk_partitioning">
            <xccdf-1.2:title xml:lang="en-US">Disk Partitioning</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">To ensure separation and protection of data, there
are top-level system directories which should be placed on their
own physical partition or logical volume. The installer's default
partitioning scheme creates separate logical volumes for
<html:code>/</html:code>, <html:code>/boot</html:code>, and <html:code>swap</html:code>.
<html:ul><html:li>If starting with any of the default layouts, check the box to
\"Review and modify partitioning.\" This allows for the easy creation
of additional logical volumes inside the volume group already
created, though it may require making <html:code>/</html:code>'s logical volume smaller to
create space. In general, using logical volumes is preferable to
using partitions because they can be more easily adjusted
later.</html:li><html:li>If creating a custom layout, create the partitions mentioned in
the previous paragraph (which the installer will require anyway),
as well as separate ones described in the following sections.</html:li></html:ul>
If a system has already been installed, and the default
partitioning
scheme was used, it is possible but nontrivial to
modify it to create separate logical volumes for the directories
listed above. The Logical Volume Manager (LVM) makes this possible.
See the LVM HOWTO at 
    <html:a href="http://tldp.org/HOWTO/LVM-HOWTO/">http://tldp.org/HOWTO/LVM-HOWTO/</html:a>
for more detailed information on LVM.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome">
            <xccdf-1.2:title xml:lang="en-US">GNOME Desktop Environment</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">GNOME is a graphical desktop environment bundled with many Linux distributions that
allow users to easily interact with the operating system graphically rather than
textually. The GNOME Graphical Display Manager (GDM) provides login, logout, and user
switching contexts as well as display server management.
<html:br/><html:br/>
GNOME is developed by the GNOME Project and is considered the default

Red Hat Graphical environment.

<html:br/><html:br/>
For more information on GNOME and the GNOME Project, see <html:b><html:a href="https://www.gnome.org">https://www.gnome.org</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:gdm"/>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" selected="false" role="full" severity="high">
              <xccdf-1.2:title xml:lang="en-US">Make sure that the dconf databases are up-to-date with regards to respective keyfiles</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">By default, DConf uses a binary database as a data backend.
The system-level database is compiled from keyfiles in the /etc/dconf/db/ directory by the <html:pre>dconf update</html:pre> command.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Unlike text-based keyfiles, the binary database is impossible to check by OVAL.
Therefore, in order to evaluate dconf configuration, both have to be true at the same time -
configuration files have to be compliant, and the database needs to be more recent than those keyfiles,
which gives confidence that it reflects them.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:fix id="dconf_db_up_to_date" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-dconf_db_up_to_date:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-dconf_db_up_to_date_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_login_screen">
              <xccdf-1.2:title xml:lang="en-US">Configure GNOME Login Screen</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">In the default GNOME desktop, the login is displayed after system boot
and can display user accounts, allow users to reboot the system, and allow users to
login automatically and/or with a guest account. The login screen should be configured
to prevent such behavior.
<html:br/><html:br/>

For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/desktop_migration_and_administration_guide</html:a>/&gt;</html:b> and the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_media_settings">
              <xccdf-1.2:title xml:lang="en-US">GNOME Media Settings</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">GNOME media settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_network_settings">
              <xccdf-1.2:title xml:lang="en-US">GNOME Network Settings</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">GNOME network settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_remote_access_settings">
              <xccdf-1.2:title xml:lang="en-US">GNOME Remote Access Settings</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">GNOME remote access settings that apply to the graphical interface.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_screen_locking">
              <xccdf-1.2:title xml:lang="en-US">Configure GNOME Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">In the default GNOME3 desktop, the screen can be locked
by selecting the user name in the far right corner of the main panel and
selecting <html:b>Lock</html:b>.
<html:br/><html:br/>
The following sections detail commands to enforce idle activation of the screensaver,
screen locking, a blank-screen screensaver, and an idle activation time.
<html:br/><html:br/>
Because users should be trained to lock the screen when they
step away from the computer, the automatic locking feature is only
meant as a backup.
<html:br/><html:br/>
The root account can be screen-locked; however, the root account should
<html:i>never</html:i> be used to log into an X Windows environment and should only
be used to for direct login via console in emergency circumstances.
<html:br/><html:br/>
For more information about enforcing preferences in the GNOME3 environment using the DConf
configuration system, see <html:b><html:a href="http://wiki.gnome.org/dconf">http://wiki.gnome.org/dconf</html:a></html:b> and
the man page <html:code>dconf(1)</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_inactivity_timeout_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">Screensaver Inactivity timeout</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Choose allowed duration (in seconds) of inactive graphical sessions</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
                <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay" type="number">
                <xccdf-1.2:title xml:lang="en-US">Screensaver Lock Delay</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Choose allowed duration (in seconds) after a screensaver becomes active before displaying an authentication prompt</xccdf-1.2:description>
                <xccdf-1.2:value selector="10_seconds">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="5_seconds">5</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="immediate">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Enable GNOME3 Screensaver Idle Activation</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To activate the screensaver in the GNOME3 desktop after a period of inactivity,
add or set <html:code>idle-activation-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
idle-activation-enabled=true</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/idle-activation-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock.
<html:br/><html:br/>
Enabling idle activation of the screensaver ensures the screensaver will
be activated after the idle delay.  Applications requiring continuous,
real-time screen display (such as network management products) require the
login session does not have administrator rights and the display station is located in a
controlled-access area.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_idle_activation_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-activation-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*idle-activation-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*idle-activation-enabled\\s*=\\s*.*/idle-activation-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\idle-activation-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/idle-activation-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_idle_activation_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Idle Activation
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: idle-activation-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME idle-activation-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/idle-activation-enabled$
    line: /org/gnome/desktop/screensaver/idle-activation-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_activation_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set GNOME3 Screensaver Inactivity Timeout</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The idle time-out value for inactivity in the GNOME3 desktop is configured via the <html:code>idle-delay</html:code>
setting must be set under an appropriate configuration file(s) in the <html:code>/etc/dconf/db/local.d</html:code> directory
and locked in <html:code>/etc/dconf/db/local.d/locks</html:code> directory to prevent user modification.
<html:br/><html:br/>
For example, to configure the system for a 15 minute delay, add the following to
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>:
<html:pre>[org/gnome/desktop/session]
idle-delay=uint32 900</html:pre>
Once the setting has been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/session/idle-delay</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000057</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000029-GPOS-00010</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_idle_delay" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then


inactivity_timeout_value="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>"



# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/session\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/session]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "idle-delay" "uint32 ${inactivity_timeout_value}" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "uint32 ${inactivity_timeout_value}")"
    if grep -q "^\\s*idle-delay\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*idle-delay\\s*=\\s*.*/idle-delay=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/session\\]|a\\idle-delay=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/session/idle-delay$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/session/idle-delay" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_idle_delay" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
- name: XCCDF Value inactivity_timeout_value # promote to variable
  set_fact:
    inactivity_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set GNOME3 Screensaver Inactivity Timeout
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/session
    option: idle-delay
    value: uint32 {{ inactivity_timeout_value }}
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME idle-delay
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/session/idle-delay$
    line: /org/gnome/desktop/session/idle-delay
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_idle_delay
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-inactivity_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_inactivity_timeout_value"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Enable GNOME3 Screensaver Lock After Idle Period</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">
To activate locking of the screensaver in the GNOME3 desktop when it is activated,
add or set <html:code>lock-enabled</html:code> to <html:code>true</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
lock-enabled=true
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/lock-enabled</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000056</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000058</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000028-GPOS-00009</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000030-GPOS-00011</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_lock_enabled" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "lock-enabled" "true" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "true")"
    if grep -q "^\\s*lock-enabled\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*lock-enabled\\s*=\\s*.*/lock-enabled=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-enabled=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/lock-enabled" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_lock_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Enable GNOME3 Screensaver Lock After Idle Period
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: lock-enabled
    value: 'true'
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME lock-enabled
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/lock-enabled$
    line: /org/gnome/desktop/screensaver/lock-enabled
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Check GNOME3 screenserver disable-lock-screen false
  command: gsettings get org.gnome.desktop.lockdown disable-lock-screen
  register: cmd_out
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Update GNOME3 screenserver disable-lock-screen false
  command: gsettings set org.gnome.desktop.lockdown disable-lock-screen false
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ansible_distribution == 'SLES'
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_lock_enabled
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Implement Blank Screensaver</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">


To set the screensaver mode in the GNOME3 desktop to a blank screen,
add or set <html:code>picture-uri</html:code> to <html:code>string ''</html:code> in
<html:code>/etc/dconf/db/local.d/00-security-settings</html:code>. For example:
<html:pre>[org/gnome/desktop/screensaver]
picture-uri=''
</html:pre>
Once the settings have been added, add a lock to
<html:code>/etc/dconf/db/local.d/locks/00-security-settings-lock</html:code> to prevent user modification.
For example:
<html:pre>/org/gnome/desktop/screensaver/picture-uri</html:pre>
After the settings have been set, run <html:code>dconf update</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-11(1).1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000031-GPOS-00012</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Setting the screensaver mode to blank-only conceals the
contents of the display from passersby.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_mode_blank" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q gdm &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

# Check for setting in any of the DConf db directories
# If files contain ibus or distro, ignore them.
# The assignment assumes that individual filenames don't contain :
readarray -t SETTINGSFILES &lt; &lt;(grep -r "\\[org/gnome/desktop/screensaver\\]" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
DCONFFILE="/etc/dconf/db/local.d/00-security-settings"
DBDIR="/etc/dconf/db/local.d"

mkdir -p "${DBDIR}"

if [ "${#SETTINGSFILES[@]}" -eq 0 ]
then
    [ ! -z ${DCONFFILE} ] || echo "" &gt;&gt; ${DCONFFILE}
    printf '%s\n' "[org/gnome/desktop/screensaver]" &gt;&gt; ${DCONFFILE}
    printf '%s=%s\n' "picture-uri" "string ''" &gt;&gt; ${DCONFFILE}
else
    escaped_value="$(sed -e 's/\\/\\\\/g' &lt;&lt;&lt; "string ''")"
    if grep -q "^\\s*picture-uri\\s*=" "${SETTINGSFILES[@]}"
    then
        
        sed -i "s/\\s*picture-uri\\s*=\\s*.*/picture-uri=${escaped_value}/g" "${SETTINGSFILES[@]}"
    else
        sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\picture-uri=${escaped_value}" "${SETTINGSFILES[@]}"
    fi
fi

dconf update
# Check for setting in any of the DConf db directories
LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/picture-uri$" "/etc/dconf/db/" | grep -v 'distro\|ibus' | cut -d":" -f1)
LOCKSFOLDER="/etc/dconf/db/local.d/locks"

mkdir -p "${LOCKSFOLDER}"

if [[ -z "${LOCKFILES}" ]]
then
    echo "/org/gnome/desktop/screensaver/picture-uri" &gt;&gt; "/etc/dconf/db/local.d/locks/00-security-settings-lock"
fi

dconf update

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="dconf_gnome_screensaver_mode_blank" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Implement Blank Screensaver
  ini_file:
    dest: /etc/dconf/db/local.d/00-security-settings
    section: org/gnome/desktop/screensaver
    option: picture-uri
    value: string ''
    create: true
    no_extra_spaces: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Prevent user modification of GNOME picture-uri
  lineinfile:
    path: /etc/dconf/db/local.d/locks/00-security-settings-lock
    regexp: ^/org/gnome/desktop/screensaver/picture-uri$
    line: /org/gnome/desktop/screensaver/picture-uri
    create: true
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy

- name: Dconf Update
  command: dconf update
  when:
    - '"gdm" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.5
    - NIST-800-171-3.1.10
    - NIST-800-53-AC-11(1)
    - NIST-800-53-AC-11(1).1
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.8
    - dconf_gnome_screensaver_mode_blank
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gnome_system_settings">
              <xccdf-1.2:title xml:lang="en-US">GNOME System Settings</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">GNOME provides configuration and functionality to a graphical desktop environment
that changes grahical configurations or allow a user to perform
actions that users normally would not be able to do in non-graphical mode such as
remote access configuration, power policies, Geo-location, etc.
Configuring such settings in GNOME will prevent accidential graphical configuration
changes by users from taking place.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sap_host">
            <xccdf-1.2:title xml:lang="en-US">SAP Specific Requirement</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">SAP (Systems, Applications and Products in Data Processing) is enterprise
software to manage business operations and customer relations. The
following section contains SAP specific requirement that is not part
of standard or common OS setting.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sudo">
            <xccdf-1.2:title xml:lang="en-US">Sudo</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US"><html:code>Sudo</html:code>, which stands for "su 'do'", provides the ability to delegate authority
to certain users, groups of users, or system administrators. When configured for system
users and/or groups, <html:code>Sudo</html:code> can allow a user or group to execute privileged commands
that normally only <html:code>root</html:code> is allowed to execute.
<html:br/><html:br/>
For more information on <html:code>Sudo</html:code> and addition <html:code>Sudo</html:code> configuration options, see
<html:b><html:a href="https://www.sudo.ws">https://www.sudo.ws</html:a></html:b>.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Group name dedicated to the use of sudo</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the name of the group that should own /usr/bin/sudo.</xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="sudogrp">sudogrp</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_logfile" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Sudo - logfile value</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the sudo logfile to use. The default value used here matches the example
location from CIS, which uses /var/log/sudo.log.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/log/sudo.log</xccdf-1.2:value>
              <xccdf-1.2:value selector="var_log_sudo_log">/var/log/sudo.log</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout" type="string">
              <xccdf-1.2:title xml:lang="en-US">Sudo - passwd_timeout value</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Defines the number of minutes before the <html:code>sudo</html:code> password prompt times out.
Defining 0 means no timeout. The default timeout value is 5 minutes.</xccdf-1.2:description>
              <xccdf-1.2:value>5</xccdf-1.2:value>
              <xccdf-1.2:value selector="infinite">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1_minute">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2_minutes">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3_minutes">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout" type="string">
              <xccdf-1.2:title xml:lang="en-US">Sudo - timestamp_timeout value</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Defines the number of minutes that can elapse before <html:code>sudo</html:code> will ask for a passwd again.
If set to a value less than 0 the user's time stamp will never expire. Defining 0 means always prompt for a 
password. The default timeout value is 5 minutes.</xccdf-1.2:description>
              <xccdf-1.2:value>5</xccdf-1.2:value>
              <xccdf-1.2:value selector="always_prompt">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1_minute">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2_minutes">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3_minutes">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_minutes">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_minutes">15</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sudo_umask" type="string">
              <xccdf-1.2:title xml:lang="en-US">Sudo - umask value</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the sudo umask to use. The actual umask value that is used is the union
of the user's umask and the sudo umask.
The default sudo umask is 0022. This guarantess sudo never lowers the umask when
running a command.</xccdf-1.2:description>
              <xccdf-1.2:value>0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0022">0022</xccdf-1.2:value>
              <xccdf-1.2:value selector="0027">0027</xccdf-1.2:value>
            </xccdf-1.2:Value>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_system-tools">
            <xccdf-1.2:title xml:lang="en-US">System Tooling / Utilities</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The following checks evaluate the system for recommended base packages -- both for installation
and removal.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_updating">
            <xccdf-1.2:title xml:lang="en-US">Updating Software</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>dnf</html:code> command line tool is used to install and
update software packages. The system also provides a graphical
software update tool in the <html:b>System</html:b> menu, in the <html:b>Administration</html:b> submenu,
called <html:b>Software Update</html:b>.
<html:br/><html:br/>
Fedora systems contain an installed software catalog called
the RPM database, which records metadata of installed packages. Consistently using
<html:code>dnf</html:code> or the graphical <html:b>Software Update</html:b> for all software installation
allows for insight into the current inventory of installed software on the system.
<html:br/><html:br/></xccdf-1.2:description>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" selected="false" role="full" severity="high">
              <xccdf-1.2:title xml:lang="en-US">Ensure Fedora GPG Key Installed</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To ensure the system can cryptographically verify base software
packages come from Fedora (and to connect to the Fedora Network to
receive them), the Fedora GPG key must properly be installed.
To install the Fedora GPG key, run one of the commands below, depending on your Fedora vesion:
<html:pre>$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-34-primary</html:pre>"
<html:pre>$ sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-33-primary</html:pre>"</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Changes to software components can have significant effects on the
overall security of the operating system. This requirement ensures
the software has not been tampered with and that it has been provided
by a trusted vendor. The Fedora GPG key is necessary to
cryptographically verify packages are from Fedora."</xccdf-1.2:rationale>
              <xccdf-1.2:fix id="ensure_fedora_gpgkey_installed" system="urn:xccdf:fix:script:sh">
dnf install -y gpg

fedora_version=$(grep -oP '[[:digit:]]+' /etc/redhat-release)

function get_release_fingerprint {
    if [ "${fedora_version}" -eq "34" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="8C5BA6990BDB26E19F2A1A801161AE6945719A39"
    elif [ "${fedora_version}" -eq "33" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="963A2BEB02009608FE67EA4249FD77499570FF31"
    elif [ "${fedora_version}" -eq "35" ]; then
        readonly FEDORA_RELEASE_FINGERPRINT="787EA6AE1147EEE56C40B30CDB4639719867C58F"
    else
        printf '%s\n' "This Fedora version '$fedora_version' is not supported anymore, please upgrade to a newer version." &gt;&amp;2
        return 1
    fi
}

# Location of the key we would like to import (once it's integrity verified)
readonly REDHAT_RELEASE_KEY="/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-${fedora_version}-primary"

RPM_GPG_DIR_PERMS=$(stat -c %a "$(dirname "$REDHAT_RELEASE_KEY")")

function remediate_gpgkey_installed {
    # Return if there was an issue getting the release fingerprint
    get_release_fingerprint || return 1
    # Verify /etc/pki/rpm-gpg directory permissions are safe
    if [ "${RPM_GPG_DIR_PERMS}" -le "755" ]; then
        # If they are safe, try to obtain fingerprints from the key file
        # (to ensure there won't be e.g. CRC error).
        readarray -t GPG_OUT &lt; &lt;(gpg --show-keys --with-fingerprint --with-colons "${REDHAT_RELEASE_KEY}" | grep '^fpr' | cut -d ":" -f 10)
        GPG_RESULT=$?
        # No CRC error, safe to proceed
        if [ "${GPG_RESULT}" -eq "0" ]; then
            echo "${GPG_OUT}" | grep -vE "${FEDORA_RELEASE_FINGERPRINT}" || {
            # If file doesn't contain any keys with unknown fingerprint, import it
            rpm --import "${REDHAT_RELEASE_KEY}"
            }
        fi
    fi
}

remediate_gpgkey_installed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-ensure_fedora_gpgkey_installed:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-ensure_fedora_gpgkey_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" selected="false" role="full" severity="high">
              <xccdf-1.2:title xml:lang="en-US">Ensure gpgcheck Enabled In Main dnf Configuration</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>gpgcheck</html:code> option controls whether
RPM packages' signatures are always checked prior to installation.
To configure dnf to check package signatures before installing
them, ensure the following line appears in <html:code>/etc/dnf/dnf.conf</html:code> in
the <html:code>[main]</html:code> section:
<html:pre>gpgcheck=1</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000366-VMM-001430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000370-VMM-001460</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
<html:br/>
Accordingly, patches, service packs, device drivers, or operating system
components must be signed with a certificate recognized and approved by the
organization.
<html:br/>Verifying the authenticity of the software prior to installation
validates the integrity of the patch or upgrade received from a vendor.
This ensures the software has not been tampered with and that it has been
provided by a trusted vendor. Self-signed certificates are disallowed by
this requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA).</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:yum"/>
              <xccdf-1.2:fix id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q yum; then

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/dnf/dnf.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^gpgcheck")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "1"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^gpgcheck\\&gt;" "/etc/dnf/dnf.conf"; then
    "${sed_command[@]}" "s/^gpgcheck\\&gt;.*/$formatted_output/gi" "/etc/dnf/dnf.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/dnf/dnf.conf" &gt;&gt; "/etc/dnf/dnf.conf"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/dnf/dnf.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="ensure_gpgcheck_globally_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Check existence of yum on Fedora
  stat:
    path: /etc/yum.conf
  register: yum_config_file
  check_mode: false
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check is globally activated (yum)
  ini_file:
    dest: /etc/yum.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when:
    - '"yum" in ansible_facts.packages'
    - (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution
      == "Scientific" or yum_config_file.stat.exists)
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy

- name: Ensure GPG check is globally activated (dnf)
  ini_file:
    dest: /etc/dnf/dnf.conf
    section: main
    option: gpgcheck
    value: 1
    no_extra_spaces: true
    create: false
  when:
    - '"yum" in ansible_facts.packages'
    - ansible_distribution == "Fedora"
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - ensure_gpgcheck_globally_activated
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
    - unknown_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" selected="false" role="full" severity="high">
              <xccdf-1.2:title xml:lang="en-US">Ensure gpgcheck Enabled for All dnf Package Repositories</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To ensure signature checking is not disabled for
any repos, remove any lines from files in <html:code>/etc/yum.repos.d</html:code> of the form:
<html:pre>gpgcheck=0</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R15)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI06.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001749</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(c)(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-5(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-12(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SA-12(10)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-11(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FPT_TUD_EXT.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000366-GPOS-00153</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000366-VMM-001430</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000370-VMM-001460</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000404-VMM-001650</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Verifying the authenticity of the software prior to installation validates
the integrity of the patch or upgrade received from a vendor. This ensures
the software has not been tampered with and that it has been provided by a
trusted vendor. Self-signed certificates are disallowed by this
requirement. Certificates used to verify the software must be from an
approved Certificate Authority (CA)."</xccdf-1.2:rationale>
              <xccdf-1.2:fix id="ensure_gpgcheck_never_disabled" system="urn:xccdf:fix:script:sh">sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/*
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="ensure_gpgcheck_never_disabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="enable">- name: Grep for dnf repo section names
  shell: |
    set -o pipefail
    grep -HEr '^\[.+\]' -r /etc/yum.repos.d/
  register: repo_grep_results
  ignore_errors: true
  changed_when: false
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed

- name: Set gpgcheck=1 for each dnf repo
  ini_file:
    path: '{{ item[0] }}'
    section: '{{ item[1] }}'
    option: gpgcheck
    value: '1'
    no_extra_spaces: true
  loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
    }}'
  tags:
    - CJIS-5.10.4.1
    - NIST-800-171-3.4.8
    - NIST-800-53-CM-11(a)
    - NIST-800-53-CM-11(b)
    - NIST-800-53-CM-5(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SA-12
    - NIST-800-53-SA-12(10)
    - NIST-800-53-SC-12
    - NIST-800-53-SC-12(3)
    - NIST-800-53-SI-7
    - PCI-DSS-Req-6.2
    - enable_strategy
    - ensure_gpgcheck_never_disabled
    - high_severity
    - low_complexity
    - medium_disruption
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-ensure_gpgcheck_never_disabled:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="false" role="full" severity="high">
              <xccdf-1.2:title xml:lang="en-US">Ensure Software Patches Installed</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US"><html:br/><html:br/>
NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy
dictates.</xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">Fedora does not have a corresponding OVAL CVE Feed. Therefore, this will result in a "not checked" result during a scan.</xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R08)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">20</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.10.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SI-2(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.RA-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Installing software updates is a fundamental mitigation against
the exploitation of publicly-known vulnerabilities. If the most
recent security patches and updates are not installed, unauthorized
users may take advantage of weaknesses in the unpatched software. The
lack of prompt attention to patching could result in a system compromise.</xccdf-1.2:rationale>
              <xccdf-1.2:fix id="security_patches_up_to_date" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="high" strategy="patch">- name: Security patches are up to date
  package:
    name: '*'
    state: latest
  tags:
    - CJIS-5.10.4.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SI-2(5)
    - NIST-800-53-SI-2(c)
    - PCI-DSS-Req-6.2
    - high_disruption
    - high_severity
    - low_complexity
    - patch_strategy
    - reboot_required
    - security_patches_up_to_date
    - skip_ansible_lint
</xccdf-1.2:fix>
            </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts">
          <xccdf-1.2:title xml:lang="en-US">Account and Access Control</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">In traditional Unix security, if an attacker gains
shell access to a certain login account, they can perform any action
or access any file to which that account has access. Therefore,
making it more difficult for unauthorized people to gain shell
access to accounts, particularly to privileged accounts, is a
necessary part of securing a system. This section introduces
mechanisms for restricting access to accounts under
Fedora.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-banners">
            <xccdf-1.2:title xml:lang="en-US">Warning Banners for System Accesses</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Each system should expose as little information about
itself as possible.
<html:br/><html:br/>
System banners, which are typically displayed just before a
login prompt, give out information about the service or the host's
operating system. This might include the distribution name and the
system kernel version, and the particular version of a network
service. This information can assist intruders in gaining access to
the system as it can reveal whether the system is running
vulnerable software. Most network services can be configured to
limit what information is displayed.
<html:br/><html:br/>
Many organizations implement security policies that require a
system banner provide notice of the system's ownership, provide
warning to unauthorized users, and remind authorized users of their
consent to monitoring.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_login_banner_text" type="string">
              <xccdf-1.2:title xml:lang="en-US">Login Banner Verbiage</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
              <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="cis_default">Authorized uses only. All activity may be monitored and reported.</xccdf-1.2:value>
              <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
              <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_gui_login_banner">
              <xccdf-1.2:title xml:lang="en-US">Implement a GUI Warning Banner</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">In the default graphical environment, users logging
directly into the system are greeted with a login screen provided
by the GNOME Display Manager (GDM). The warning banner should be
displayed in this graphical environment for these users.
The following sections describe how to configure the GDM login
banner.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:gdm"/>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-pam">
            <xccdf-1.2:title xml:lang="en-US">Protect Accounts by Configuring PAM</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">PAM, or Pluggable Authentication Modules, is a system
which implements modular authentication for Linux programs. PAM provides
a flexible and configurable architecture for authentication, and it should be configured
to minimize exposure to unnecessary risk. This section contains
guidance on how to accomplish that.
<html:br/><html:br/>
PAM is implemented as a set of shared objects which are
loaded and invoked whenever an application wishes to authenticate a
user. Typically, the application must be running as root in order
to take advantage of PAM, because PAM's modules often need to be able
to access sensitive stores of account information, such as /etc/shadow.
Traditional privileged network listeners
(e.g. sshd) or SUID programs (e.g. sudo) already meet this
requirement. An SUID root application, userhelper, is provided so
that programs which are not SUID or privileged themselves can still
take advantage of PAM.
<html:br/><html:br/>
PAM looks in the directory <html:code>/etc/pam.d</html:code> for
application-specific configuration information. For instance, if
the program login attempts to authenticate a user, then PAM's
libraries follow the instructions in the file <html:code>/etc/pam.d/login</html:code>
to determine what actions should be taken.
<html:br/><html:br/>
One very important file in <html:code>/etc/pam.d</html:code> is
<html:code>/etc/pam.d/system-auth</html:code>. This file, which is included by
many other PAM configuration files, defines 'default' system authentication
measures. Modifying this file is a good way to make far-reaching
authentication changes, for instance when implementing a
centralized authentication service.</xccdf-1.2:description>
            <xccdf-1.2:warning xml:lang="en-US" category="functionality">Be careful when making changes to PAM's configuration files.
The syntax for these files is complex, and modifications can
have unexpected consequences. The default configurations shipped
with applications should be sufficient for most users.</xccdf-1.2:warning>
            <xccdf-1.2:warning xml:lang="en-US" category="functionality">Running <html:code>authconfig</html:code> or <html:code>system-config-authentication</html:code>
will re-write the PAM configuration files, destroying any manually
made changes and replacing them with a series of system defaults.
One reference to the configuration file syntax can be found at

<html:a href="http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html">http://www.linux-pam.org/Linux-PAM-html/sag-configuration-file.html</html:a>.</xccdf-1.2:warning>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" type="string">
              <xccdf-1.2:title xml:lang="en-US">Password Hashing algorithm</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the system default encryption algorithm for encrypting passwords.
Defines the value set as ENCRYPT_METHOD in /etc/login.defs.</xccdf-1.2:description>
              <xccdf-1.2:value>SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA512">SHA512</xccdf-1.2:value>
              <xccdf-1.2:value selector="SHA256">SHA256</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" type="number">
              <xccdf-1.2:title xml:lang="en-US">remember</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The last n passwords for each user are saved in
<html:code>/etc/security/opasswd</html:code> in order to force password change history and
keep the user from alternating between the same password too
frequently.</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="24">24</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_display_login_attempts" selected="false" role="full" severity="low">
              <xccdf-1.2:title xml:lang="en-US">Ensure PAM Displays Last Logon/Access Notification</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To configure the system to notify users of last logon/access
using <html:code>pam_lastlog</html:code>, add or correct the <html:code>pam_lastlog</html:code>
settings in
<html:code>/etc/pam.d/postlogin</html:code> to read as follows:
<html:pre>session     required pam_lastlog.so showfailed</html:pre>
And make sure that the <html:code>silent</html:code> option is not set.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-9(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Users need to be aware of activity that occurs regarding
their account. Providing users with information regarding the number
of unsuccessful attempts that were made to login to their account
allows the user to determine if any unauthorized activity has occurred
and gives them an opportunity to notify administrators.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:pam"/>
              <xccdf-1.2:fix id="display_login_attempts" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

if [ -e "/etc/pam.d/postlogin" ] ; then
    valueRegex="" defaultValue=""
    # non-empty values need to be preceded by an equals sign
    [ -n "${valueRegex}" ] &amp;&amp; valueRegex="=${valueRegex}"
    # add an equals sign to non-empty values
    [ -n "${defaultValue}" ] &amp;&amp; defaultValue="=${defaultValue}"

    # fix 'type' if it's wrong
    if grep -q -P "^\\s*(?"'!'"session\\s)[[:alnum:]]+\\s+[[:alnum:]]+\\s+pam_lastlog.so" &lt; "/etc/pam.d/postlogin" ; then
        sed --follow-symlinks -i -E -e "s/^(\\s*)[[:alnum:]]+(\\s+[[:alnum:]]+\\s+pam_lastlog.so)/\\1session\\2/" "/etc/pam.d/postlogin"
    fi

    # fix 'control' if it's wrong
    if grep -q -P "^\\s*session\\s+(?"'!'"required)[[:alnum:]]+\\s+pam_lastlog.so" &lt; "/etc/pam.d/postlogin" ; then
        sed --follow-symlinks -i -E -e "s/^(\\s*session\\s+)[[:alnum:]]+(\\s+pam_lastlog.so)/\\1required\\2/" "/etc/pam.d/postlogin"
    fi

    # fix the value for 'option' if one exists but does not match 'valueRegex'
    if grep -q -P "^\\s*session\\s+required\\s+pam_lastlog.so(\\s.+)?\\s+showfailed(?"'!'"${valueRegex}(\\s|\$))" &lt; "/etc/pam.d/postlogin" ; then
        sed --follow-symlinks -i -E -e "s/^(\\s*session\\s+required\\s+pam_lastlog.so(\\s.+)?\\s)showfailed=[^[:space:]]*/\\1showfailed${defaultValue}/" "/etc/pam.d/postlogin"

    # add 'option=default' if option is not set
    elif grep -q -E "^\\s*session\\s+required\\s+pam_lastlog.so" &lt; "/etc/pam.d/postlogin" &amp;&amp;
            grep    -E "^\\s*session\\s+required\\s+pam_lastlog.so" &lt; "/etc/pam.d/postlogin" | grep -q -E -v "\\sshowfailed(=|\\s|\$)" ; then

        sed --follow-symlinks -i -E -e "s/^(\\s*session\\s+required\\s+pam_lastlog.so[^\\n]*)/\\1 showfailed${defaultValue}/" "/etc/pam.d/postlogin"
    # add a new entry if none exists
    elif ! grep -q -P "^\\s*session\\s+required\\s+pam_lastlog.so(\\s.+)?\\s+showfailed${valueRegex}(\\s|\$)" &lt; "/etc/pam.d/postlogin" ; then
        echo "session required pam_lastlog.so showfailed${defaultValue}" &gt;&gt; "/etc/pam.d/postlogin"
    fi
else
    echo "/etc/pam.d/postlogin doesn't exist" &gt;&amp;2
fi

# remove 'silent' option
sed -i --follow-symlinks -E -e 's/^([^#]+pam_lastlog\.so[^#]*)\ssilent/\1/' '/etc/pam.d/postlogin'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="display_login_attempts" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Check if pam_lastlog.so is set
  lineinfile:
    path: /etc/pam.d/postlogin
    regexp: ^\s*(session)(\s+)[^\s]+(\s+)(pam_lastlog\.so)(\s+)(.*)
    state: absent
  check_mode: true
  changed_when: false
  register: pam_lastlog_exists
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Make sure pam_lastlog.so control is required
  replace:
    path: /etc/pam.d/postlogin
    regexp: ^\s*(session)(\s+)[^\s]+(\s+)(pam_lastlog\.so)(\s+)(.*)
    replace: \1\2required\3\4\5\6
  register: control_update_result
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Add control for pam_lastlog.so module
  lineinfile:
    path: /etc/pam.d/postlogin
    line: session required pam_lastlog.so showfailed
  when:
    - '"pam" in ansible_facts.packages'
    - not pam_lastlog_exists.found
  register: add_new_pam_lastlog_control_result
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Add 'showfailed' arg to pam_lastlog.so module
  pamd:
    name: postlogin
    type: session
    control: required
    module_path: pam_lastlog.so
    module_arguments: showfailed
    state: args_present
  when:
    - '"pam" in ansible_facts.packages'
    - not add_new_pam_lastlog_control_result.changed
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed

- name: Remove 'silent' arg for pam_lastlog.so module
  pamd:
    name: postlogin
    type: session
    control: required
    module_path: pam_lastlog.so
    module_arguments: silent
    state: args_absent
  when:
    - '"pam" in ansible_facts.packages'
    - not add_new_pam_lastlog_control_result.changed
  tags:
    - CJIS-5.5.2
    - NIST-800-53-AC-9(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.4
    - configure_strategy
    - display_login_attempts
    - low_complexity
    - low_disruption
    - low_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-display_login_attempts:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-display_login_attempts_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_locking_out_password_attempts">
              <xccdf-1.2:title xml:lang="en-US">Set Lockouts for Failed Password Attempts</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>pam_faillock</html:code> PAM module provides the capability to
lock out user accounts after a number of failed login attempts. Its
documentation is available in
<html:code>/usr/share/doc/pam-VERSION/txts/README.pam_faillock</html:code>.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">Locking out user accounts presents the
risk of a denial-of-service attack. The lockout policy
must weigh whether the risk of such a
denial-of-service attack outweighs the benefits of thwarting
password guessing attacks.</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" type="number">
                <xccdf-1.2:title xml:lang="en-US">fail_deny</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Number of failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" type="number">
                <xccdf-1.2:title xml:lang="en-US">fail_interval</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Interval for counting failed login attempts before account lockout</xccdf-1.2:description>
                <xccdf-1.2:value selector="100000000">100000000</xccdf-1.2:value>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>900</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" type="number">
                <xccdf-1.2:title xml:lang="en-US">fail_unlock_time</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Seconds before automatic unlocking or permanently locking after excessive failed logins</xccdf-1.2:description>
                <xccdf-1.2:value selector="1800">1800</xccdf-1.2:value>
                <xccdf-1.2:value selector="3600">3600</xccdf-1.2:value>
                <xccdf-1.2:value selector="600">600</xccdf-1.2:value>
                <xccdf-1.2:value selector="604800">604800</xccdf-1.2:value>
                <xccdf-1.2:value selector="86400">86400</xccdf-1.2:value>
                <xccdf-1.2:value selector="900">900</xccdf-1.2:value>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="never">0</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_delay" type="number">
                <xccdf-1.2:title xml:lang="en-US">faildelay_delay</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Delay next login attempt after a failed login</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="4000000">4000000</xccdf-1.2:value>
                <xccdf-1.2:value>4000000</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember" type="number">
                <xccdf-1.2:title xml:lang="en-US">pwhistory_remember</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Prevent password re-use using password history lookup</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value selector="9">9</xccdf-1.2:value>
                <xccdf-1.2:value>5</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag" type="string">
                <xccdf-1.2:title xml:lang="en-US">PAM pwhistory remember - control flag</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the control flag required for password remember requirement.</xccdf-1.2:description>
                <xccdf-1.2:value selector="required">required</xccdf-1.2:value>
                <xccdf-1.2:value selector="optional">optional</xccdf-1.2:value>
                <xccdf-1.2:value selector="requisite">requisite</xccdf-1.2:value>
                <xccdf-1.2:value selector="sufficient">sufficient</xccdf-1.2:value>
                <xccdf-1.2:value selector="binding">binding</xccdf-1.2:value>
                <xccdf-1.2:value>requisite</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_tally2" type="number">
                <xccdf-1.2:title xml:lang="en-US">tally2</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Number of failed login attempts</xccdf-1.2:description>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value>3</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Limit Password Reuse</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Do not allow users to reuse recent passwords. This can be
accomplished by using the <html:code>remember</html:code> option for the <html:code>pam_unix</html:code>
or <html:code>pam_pwhistory</html:code> PAM modules.
<html:br/><html:br/>
In the file <html:code>/etc/pam.d/system-auth</html:code>, append <html:code>remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:code>
to the line which refers to the <html:code>pam_unix.so</html:code> or <html:code>pam_pwhistory.so</html:code>module, as shown below:
<html:ul><html:li>for the <html:code>pam_unix.so</html:code> case:
<html:pre>password sufficient pam_unix.so <html:i>...existing_options...</html:i> remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:pre>
</html:li><html:li>for the <html:code>pam_pwhistory.so</html:code> case:
<html:pre>password requisite pam_pwhistory.so <html:i>...existing_options...</html:i> remember=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/></html:pre>
</html:li></html:ul>
The DoD STIG requirement is 5 passwords.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000200</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000077-GPOS-00045</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000077-VMM-000440</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Preventing re-use of previous passwords helps ensure that a compromised password is not re-used by a user.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:pam"/>
                <xccdf-1.2:fix id="accounts_password_pam_unix_remember" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_unix_remember="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>"



AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pamFile in "${AUTH_FILES[@]}"
do
	if grep -q "remember=" $pamFile; then
		sed -i --follow-symlinks "s/\(^password.*sufficient.*pam_unix.so.*\)\(\(remember *= *\)[^ $]*\)/\1remember=$var_password_pam_unix_remember/" $pamFile
	else
		sed -i --follow-symlinks "/^password[[:space:]]\+sufficient[[:space:]]\+pam_unix.so/ s/$/ remember=$var_password_pam_unix_remember/" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="accounts_password_pam_unix_remember" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
- name: XCCDF Value var_password_pam_unix_remember # promote to variable
  set_fact:
    var_password_pam_unix_remember: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember" use="legacy"/>
  tags:
    - always

- name: Do not allow users to reuse recent passwords - system-auth (change)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^(password\s+sufficient\s+pam_unix\.so\s.*remember\s*=\s*)(\S+)(.*)$
    replace: \g&lt;1&gt;{{ var_password_pam_unix_remember }}\g&lt;3&gt;
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed

- name: Do not allow users to reuse recent passwords - system-auth (add)
  replace:
    dest: /etc/pam.d/system-auth
    regexp: ^password\s+sufficient\s+pam_unix\.so\s(?!.*remember\s*=\s*).*$
    replace: \g&lt;0&gt; remember={{ var_password_pam_unix_remember }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.8
    - NIST-800-53-IA-5(1)(e)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.5
    - accounts_password_pam_unix_remember
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_pam_unix_remember:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Deny For Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To configure the system to lock out accounts after a number of incorrect login
attempts using <html:code>pam_faillock.so</html:code>, modify the content of both
<html:code>/etc/pam.d/system-auth</html:code> and <html:code>/etc/pam.d/password-auth</html:code> as follows:
<html:br/><html:br/>
<html:ul><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth required pam_faillock.so preauth silent deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>after</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth [default=die] pam_faillock.so authfail deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>ACCOUNT</html:code> section:
<html:pre>account required pam_faillock.so</html:pre></html:li></html:ul></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000021-VMM-000050</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:pam"/>
                <xccdf-1.2:fix id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_accounts_passwords_pam_faillock_deny="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>"



AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")

for pam_file in "${AUTH_FILES[@]}"
do
    # is auth required pam_faillock.so preauth present?
    if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*'"deny"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"deny"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ '"deny"'='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        fi
    # auth required pam_faillock.so preauth is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent '"deny"'='"$var_accounts_passwords_pam_faillock_deny" "$pam_file"
    fi
    # is auth default pam_faillock.so authfail present?
    if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*'"deny"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\('"deny"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ '"deny"'='"$var_accounts_passwords_pam_faillock_deny"'/' "$pam_file"
        fi
    # auth default pam_faillock.so authfail is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail '"deny"'='"$var_accounts_passwords_pam_faillock_deny" "$pam_file"
    fi
    if ! grep -qE '^\s*account\s+required\s+pam_faillock\.so.*$' "$pam_file" ; then
        sed -E -i --follow-symlinks '/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so' "$pam_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="accounts_passwords_pam_faillock_deny" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_deny # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_deny: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/>
  tags:
    - always

- name: Add auth pam_faillock preauth deny before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent deny={{ var_accounts_passwords_pam_faillock_deny
      }}
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add deny argument to auth pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent deny={{ var_accounts_passwords_pam_faillock_deny
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock authfail deny after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail deny={{ var_accounts_passwords_pam_faillock_deny }}
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add deny argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    new_type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail deny={{ var_accounts_passwords_pam_faillock_deny }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.6
    - accounts_passwords_pam_faillock_deny
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Lockout Time for Failed Password Attempts</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To configure the system to lock out accounts after a number of incorrect login
attempts and require an administrator to unlock the account using <html:code>pam_faillock.so</html:code>,
modify the content of both <html:code>/etc/pam.d/system-auth</html:code> and <html:code>/etc/pam.d/password-auth</html:code> as follows:
<html:br/><html:br/>
<html:ul><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth required pam_faillock.so preauth silent deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>after</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>AUTH</html:code> section:
<html:pre>auth [default=die] pam_faillock.so authfail deny=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny" use="legacy"/> unlock_time=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/> fail_interval=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval" use="legacy"/></html:pre></html:li><html:li> add the following line immediately <html:code>before</html:code> the <html:code>pam_unix.so</html:code> statement in the <html:code>ACCOUNT</html:code> section:
<html:pre>account required pam_faillock.so</html:pre></html:li></html:ul>
If <html:code>unlock_time</html:code> is set to <html:code>0</html:code>, manual intervention by an administrator is required to unlock a user.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000044</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002236</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002237</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002238</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-7(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_AFL.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000329-GPOS-00128</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000021-GPOS-00005</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000329-VMM-001180</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Locking out user accounts after a number of incorrect attempts
prevents direct password guessing attacks. Ensuring that an administrator is
involved in unlocking locked accounts draws appropriate attention to such
situations.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:pam"/>
                <xccdf-1.2:fix id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_accounts_passwords_pam_faillock_unlock_time="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>"



AUTH_FILES=("/etc/pam.d/system-auth" "/etc/pam.d/password-auth")

for pam_file in "${AUTH_FILES[@]}"
do
    # is auth required pam_faillock.so preauth present?
    if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+required\s+pam_faillock\.so\s+preauth.*'"unlock_time"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*required.*pam_faillock.so.*preauth.*silent.*\)\('"unlock_time"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*required.*pam_faillock.so.*preauth.*silent.*/ s/$/ '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        fi
    # auth required pam_faillock.so preauth is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/i auth        required      pam_faillock.so preauth silent '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time" "$pam_file"
    fi
    # is auth default pam_faillock.so authfail present?
    if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*$' "$pam_file" ; then
        # is the option set?
        if grep -qE '^\s*auth\s+(\[default=die\])\s+pam_faillock\.so\s+authfail.*'"unlock_time"'=([0-9]*).*$' "$pam_file" ; then
            # just change the value of option to a correct value
            sed -i --follow-symlinks 's/\(^auth.*[default=die].*pam_faillock.so.*authfail.*\)\('"unlock_time"' *= *\).*/\1\2'"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        # the option is not set.
        else
            # append the option
            sed -i --follow-symlinks '/^auth.*[default=die].*pam_faillock.so.*authfail.*/ s/$/ '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time"'/' "$pam_file"
        fi
    # auth default pam_faillock.so authfail is not present, insert the whole line
    else
        sed -i --follow-symlinks '/^auth.*sufficient.*pam_unix.so.*/a auth        [default=die] pam_faillock.so authfail '"unlock_time"'='"$var_accounts_passwords_pam_faillock_unlock_time" "$pam_file"
    fi
    if ! grep -qE '^\s*account\s+required\s+pam_faillock\.so.*$' "$pam_file" ; then
        sed -E -i --follow-symlinks '/^\s*account\s*required\s*pam_unix.so/i account     required      pam_faillock.so' "$pam_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="accounts_passwords_pam_faillock_unlock_time" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_passwords_pam_faillock_unlock_time # promote to variable
  set_fact:
    var_accounts_passwords_pam_faillock_unlock_time: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time" use="legacy"/>
  tags:
    - always

- name: Add auth pam_faillock preauth unlock_time before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: required
    new_module_path: pam_faillock.so
    module_arguments: preauth silent unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unlock_time argument to pam_faillock preauth
  pamd:
    name: '{{ item }}'
    type: auth
    control: required
    module_path: pam_faillock.so
    module_arguments: preauth silent unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add auth pam_faillock authfail unlock_interval after pam_unix.so
  pamd:
    name: '{{ item }}'
    type: auth
    control: sufficient
    module_path: pam_unix.so
    new_type: auth
    new_control: '[default=die]'
    new_module_path: pam_faillock.so
    module_arguments: authfail unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: after
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add unlock_time argument to auth pam_faillock authfail
  pamd:
    name: '{{ item }}'
    type: auth
    control: '[default=die]'
    module_path: pam_faillock.so
    module_arguments: authfail unlock_time={{ var_accounts_passwords_pam_faillock_unlock_time
      }}
    state: args_present
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add account pam_faillock before pam_unix.so
  pamd:
    name: '{{ item }}'
    type: account
    control: required
    module_path: pam_unix.so
    new_type: account
    new_control: required
    new_module_path: pam_faillock.so
    state: before
  loop:
    - system-auth
    - password-auth
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.5.3
    - NIST-800-171-3.1.8
    - NIST-800-53-AC-7(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.1.7
    - accounts_passwords_pam_faillock_unlock_time
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality">
              <xccdf-1.2:title xml:lang="en-US">Set Password Quality Requirements</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default <html:code>pam_pwquality</html:code> PAM module provides strength
checking for passwords. It performs a number of checks, such as
making sure passwords are not similar to dictionary words, are of
at least a certain length, are not the previous password reversed,
and are not simply a change of case from the previous password. It
can also require passwords to be in certain character classes. The
<html:code>pam_pwquality</html:code> module is the preferred way of configuring
password requirements.
<html:br/><html:br/>
The man pages <html:code>pam_pwquality(8)</html:code>
provide information on the capabilities and configuration of
each.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality_pamcracklib">
                <xccdf-1.2:title xml:lang="en-US">Set Password Quality Requirements, if using
pam_cracklib</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The <html:code>pam_cracklib</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br/><html:br/>
For example, to configure <html:code>pam_cracklib</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, locate the following line in <html:code>/etc/pam.d/system-auth</html:code>:
<html:pre>password requisite pam_cracklib.so try_first_pass retry=3</html:pre>
and then alter it to read:
<html:pre>password required pam_cracklib.so try_first_pass retry=3 maxrepeat=3 minlen=14 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 difok=4</html:pre>
If no such line exists, add one as the first line of the password section in <html:code>/etc/pam.d/system-auth</html:code>.
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that the password quality requirements are not enforced for the
root account for some reason.</xccdf-1.2:warning>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_quality_pwquality">
                <xccdf-1.2:title xml:lang="en-US">Set Password Quality Requirements with pam_pwquality</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The <html:code>pam_pwquality</html:code> PAM module can be configured to meet
requirements for a variety of policies.
<html:br/><html:br/>
For example, to configure <html:code>pam_pwquality</html:code> to require at least one uppercase
character, lowercase character, digit, and other (special)
character, make sure that <html:code>pam_pwquality</html:code> exists in <html:code>/etc/pam.d/system-auth</html:code>:
<html:pre>password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</html:pre>
If no such line exists, add one as the first line of the password section in <html:code>/etc/pam.d/system-auth</html:code>.
Next, modify the settings in <html:code>/etc/security/pwquality.conf</html:code> to match the following:
<html:pre>difok = 4
minlen = 14
dcredit = -1
ucredit = -1
lcredit = -1
ocredit = -1
maxrepeat = 3</html:pre>
The arguments can be modified to ensure compliance with
your organization's security policy. Discussion of each parameter follows.</xccdf-1.2:description>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" type="number">
                  <xccdf-1.2:title xml:lang="en-US">dcredit</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of digits in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck" type="number">
                  <xccdf-1.2:title xml:lang="en-US">dictcheck</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Prevent the use of dictionary words for passwords.</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value>1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_difok" type="number">
                  <xccdf-1.2:title xml:lang="en-US">difok</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of characters not present in old
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>8</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" type="number">
                  <xccdf-1.2:title xml:lang="en-US">lcredit</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of lower case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat" type="number">
                  <xccdf-1.2:title xml:lang="en-US">maxclassrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Maximum Number of Consecutive Repeating Characters in a Password From the Same Character Class</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>4</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat" type="number">
                  <xccdf-1.2:title xml:lang="en-US">maxrepeat</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Maximum Number of Consecutive Repeating Characters in a Password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minclass" type="number">
                  <xccdf-1.2:title xml:lang="en-US">minclass</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of categories of characters that must exist in a password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_minlen" type="number">
                  <xccdf-1.2:title xml:lang="en-US">minlen</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of characters in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                  <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                  <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                  <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                  <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                  <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                  <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                  <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                  <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                  <xccdf-1.2:value>15</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ocredit" type="number">
                  <xccdf-1.2:title xml:lang="en-US">ocredit</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of other (special characters) in
password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_retry" type="number">
                  <xccdf-1.2:title xml:lang="en-US">retry</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Number of retry attempts before erroring out</xccdf-1.2:description>
                  <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                  <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
                  <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
                  <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                  <xccdf-1.2:value>3</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" type="number">
                  <xccdf-1.2:title xml:lang="en-US">ucredit</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Minimum number of upper case in password</xccdf-1.2:description>
                  <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                  <xccdf-1.2:value selector="1">-1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="2">-2</xccdf-1.2:value>
                  <xccdf-1.2:value>-1</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Digit Characters</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The pam_pwquality module's <html:code>dcredit</html:code> parameter controls requirements for
usage of digits in a password. When set to a negative number, any password will be required to
contain that many digits. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each digit. Modify the <html:code>dcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a digit in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000194</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000071-GPOS-00039</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000071-VMM-000380</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possible combinations that need to be tested before the password is compromised.
Requiring digits makes password guessing attacks more difficult by ensuring a larger
search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:pam"/>
                  <xccdf-1.2:fix id="accounts_password_pam_dcredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_dcredit="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>"



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^dcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_dcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^dcredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^dcredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" &gt;&gt; "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="accounts_password_pam_dcredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_dcredit # promote to variable
  set_fact:
    var_password_pam_dcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable dcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*dcredit
    line: dcredit = {{ var_password_pam_dcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_dcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_pam_dcredit:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The pam_pwquality module's <html:code>lcredit</html:code> parameter controls requirements for
usage of lowercase letters in a password. When set to a negative number, any password will be required to
contain that many lowercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each lowercase character. Modify the <html:code>lcredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of a lowercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000193</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000070-GPOS-00038</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000070-VMM-000370</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Use of a complex password helps to increase the time and resources required
to compromise the password. Password complexity, or strength, is a measure of
the effectiveness of a password in resisting attempts at guessing and brute-force
attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes
to crack a password. The more complex the password, the greater the number of
possble combinations that need to be tested before the password is compromised.
Requiring a minimum number of lowercase characters makes password guessing attacks
more difficult by ensuring a larger search space.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:pam"/>
                  <xccdf-1.2:fix id="accounts_password_pam_lcredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_lcredit="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>"



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^lcredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_lcredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^lcredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^lcredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" &gt;&gt; "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="accounts_password_pam_lcredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_lcredit # promote to variable
  set_fact:
    var_password_pam_lcredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable lcredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*lcredit
    line: lcredit = {{ var_password_pam_lcredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_lcredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_pam_lcredit:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Length</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The pam_pwquality module's <html:code>minlen</html:code> parameter controls requirements for
minimum characters required in a password. Add <html:code>minlen=<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/></html:code>
after pam_pwquality to set minimum password length requirements.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000205</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000078-GPOS-00046</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000072-VMM-000390</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000078-VMM-000450</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
<html:br/>
Password complexity, or strength, is a measure of the effectiveness of a
password in resisting attempts at guessing and brute-force attacks.
Password length is one factor of several that helps to determine strength
and how long it takes to crack a password. Use of more characters in a password
helps to exponentially increase the time and/or resources required to
compromose the password.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:pam"/>
                  <xccdf-1.2:fix id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_minlen="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>"



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^minlen")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_minlen"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^minlen\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^minlen\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" &gt;&gt; "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="accounts_password_pam_minlen" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_minlen # promote to variable
  set_fact:
    var_password_pam_minlen: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable minlen is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*minlen
    line: minlen = {{ var_password_pam_minlen }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_minlen
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The pam_pwquality module's <html:code>ucredit=</html:code> parameter controls requirements for
usage of uppercase letters in a password. When set to a negative number, any password will be required to
contain that many uppercase characters. When set to a positive number, pam_pwquality will grant +1 additional
length credit for each uppercase character. Modify the <html:code>ucredit</html:code> setting in
<html:code>/etc/security/pwquality.conf</html:code> to require the use of an uppercase character in passwords.</xccdf-1.2:description>
                  <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000192</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_MOF_EXT.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000069-GPOS-00037</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000069-VMM-000360</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Use of a complex password helps to increase the time and resources reuiqred to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
<html:br/><html:br/>
Password complexity is one factor of several that determines how long it takes to crack a password. The more
complex the password, the greater the number of possible combinations that need to be tested before
the password is compromised.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:pam"/>
                  <xccdf-1.2:fix id="accounts_password_pam_ucredit" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="restrict"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then


var_password_pam_ucredit="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>"



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/security/pwquality.conf"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^ucredit")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_password_pam_ucredit"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ucredit\\&gt;" "/etc/security/pwquality.conf"; then
    "${sed_command[@]}" "s/^ucredit\\&gt;.*/$formatted_output/gi" "/etc/security/pwquality.conf"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/security/pwquality.conf" &gt;&gt; "/etc/security/pwquality.conf"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/security/pwquality.conf"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="accounts_password_pam_ucredit" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_password_pam_ucredit # promote to variable
  set_fact:
    var_password_pam_ucredit: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit" use="legacy"/>
  tags:
    - always

- name: Ensure PAM variable ucredit is set accordingly
  lineinfile:
    create: true
    dest: /etc/security/pwquality.conf
    regexp: ^#?\s*ucredit
    line: ucredit = {{ var_password_pam_ucredit }}
  when: '"pam" in ansible_facts.packages'
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(4)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - accounts_password_pam_ucredit
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_pam_ucredit:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_set_password_hashing_algorithm">
              <xccdf-1.2:title xml:lang="en-US">Set Password Hashing Algorithm</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The system's default algorithm for storing password hashes in
<html:code>/etc/shadow</html:code> is SHA-512. This can be configured in several
locations.</xccdf-1.2:description>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Password Hashing Algorithm in /etc/libuser.conf</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">In <html:code>/etc/libuser.conf</html:code>, add or correct the following line in its
<html:code>[defaults]</html:code> section to ensure the system will use the SHA-512
algorithm for password hashing:
<html:pre>crypt_style = sha512</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br/><html:br/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code>crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:libuser"/>
                <xccdf-1.2:fix id="set_password_hashing_algorithm_libuserconf" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q libuser; then

LIBUSER_CONF="/etc/libuser.conf"
CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*'

# Try find crypt_style in [defaults] section. If it is here, then change algorithm to sha512.
# If it isn't here, then add it to [defaults] section.
if grep -qzosP $CRYPT_STYLE_REGEX $LIBUSER_CONF ; then
        sed -i "s/\(crypt_style[[:space:]]*=[[:space:]]*\).*/\1sha512/g" $LIBUSER_CONF
elif grep -qs "\[defaults]" $LIBUSER_CONF ; then
        sed -i "/[[:space:]]*\[defaults]/a crypt_style = sha512" $LIBUSER_CONF
else
        echo -e "[defaults]\ncrypt_style = sha512" &gt;&gt; $LIBUSER_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="set_password_hashing_algorithm_libuserconf" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf

- name: Set Password Hashing Algorithm in /etc/libuser.conf
  lineinfile:
    dest: /etc/libuser.conf
    insertafter: ^\s*\[defaults]
    regexp: ^#?crypt_style
    line: crypt_style = sha512
    state: present
    create: true
  when: '"libuser" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_libuserconf
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Password Hashing Algorithm in /etc/login.defs</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">In <html:code>/etc/login.defs</html:code>, add or correct the following line to ensure
the system will use SHA-512 as the hashing algorithm:
<html:pre>ENCRYPT_METHOD SHA512</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard method for protecting passwords.
If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords
that are encrypted with a weak algorithm are no more protected than if they are kept in plain text.
<html:br/><html:br/>
Using a stronger hashing algorithm makes password cracking attacks more difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:login_defs"/>
                <xccdf-1.2:fix id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_password_hashing_algorithm="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>"



if grep --silent ^ENCRYPT_METHOD /etc/login.defs ; then
	sed -i "s/^ENCRYPT_METHOD .*/ENCRYPT_METHOD $var_password_hashing_algorithm/g" /etc/login.defs
else
	echo "" &gt;&gt; /etc/login.defs
	echo "ENCRYPT_METHOD $var_password_hashing_algorithm" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="set_password_hashing_algorithm_logindefs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
- name: XCCDF Value var_password_hashing_algorithm # promote to variable
  set_fact:
    var_password_hashing_algorithm: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm" use="legacy"/>
  tags:
    - always

- name: Set Password Hashing Algorithm in /etc/login.defs
  lineinfile:
    dest: /etc/login.defs
    regexp: ^#?ENCRYPT_METHOD
    line: ENCRYPT_METHOD {{ var_password_hashing_algorithm }}
    state: present
    create: true
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.2
    - NIST-800-171-3.13.11
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(c)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.1
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - set_password_hashing_algorithm_logindefs
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set PAM's Password Hashing Algorithm</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The PAM system service can be configured to only store encrypted
representations of passwords. In

<html:code>/etc/pam.d/system-auth</html:code>,

the
<html:code>password</html:code> section of the file controls which PAM modules execute
during a password change. Set the <html:code>pam_unix.so</html:code> module in the
<html:code>password</html:code> section to include the argument <html:code>sha512</html:code>, as shown
below:
<html:br/>

<html:pre>password    sufficient    pam_unix.so sha512 <html:i>other arguments...</html:i></html:pre>

<html:br/>
This will help ensure when local users change their passwords, hashes for
the new passwords will be generated using the SHA-512 algorithm. This is
the default.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R32)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.13.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000196</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000073-GPOS-00041</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
<html:br/><html:br/>
This setting ensures user and group account administration utilities are
configured to store only encrypted representations of passwords.
Additionally, the <html:code>crypt_style</html:code> configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:pam"/>
                <xccdf-1.2:fix id="set_password_hashing_algorithm_systemauth" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q pam; then

AUTH_FILES[0]="/etc/pam.d/system-auth"
AUTH_FILES[1]="/etc/pam.d/password-auth"

for pamFile in "${AUTH_FILES[@]}"
do
	if ! grep -q "^password.*sufficient.*pam_unix.so.*sha512" $pamFile; then
		sed -i --follow-symlinks "/^password.*sufficient.*pam_unix.so/ s/$/ sha512/" $pamFile
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-physical">
            <xccdf-1.2:title xml:lang="en-US">Protect Physical Console Access</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">It is impossible to fully protect a system from an
attacker with physical access, so securing the space in which the
system is located should be considered a necessary step. However,
there are some steps which, if taken, make it more difficult for an
attacker to quickly or undetectably modify a system from its
console.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_screen_locking">
              <xccdf-1.2:title xml:lang="en-US">Configure Screen Locking</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">When a user must temporarily leave an account
logged-in, screen locking should be employed to prevent passersby
from abusing the account. User education and training is
particularly important for screen locking to be effective, and policies
can be implemented to reinforce this.
<html:br/><html:br/>
Automatic screen locking is only meant as a safeguard for
those cases where a user forgot to lock the screen.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_console_screen_locking">
                <xccdf-1.2:title xml:lang="en-US">Configure Console Screen Locking</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">A console screen locking mechanism is a temporary action taken when a user
stops work and moves away from the immediate physical vicinity of the
information system but does not logout because of the temporary nature of
the absence. Rather than relying on the user to manually lock their
operation system session prior to vacating the vicinity, operating systems
need to be able to identify when a user's session has idled and take action
to initiate the session lock.</xccdf-1.2:description>
                </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smart_card_login">
                <xccdf-1.2:title xml:lang="en-US">Hardware Tokens for Authentication</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The use of hardware tokens such as smart cards for system login
provides stronger, two-factor authentication than using a username and password.

In Red Hat Enterprise Linux servers and workstations, hardware token login

is not enabled by default and must be enabled in the system settings.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smartcard_drivers" type="string" interactive="true">
                  <xccdf-1.2:title xml:lang="en-US">OpenSC Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Choose the Smart Card Driver in use by your organization.
<html:br/>For DoD, choose the <html:code>cac</html:code> driver.
<html:br/>If your driver is not listed and you don't want to use the
<html:code>default</html:code> driver, use the <html:code>other</html:code> option and
manually specify your driver.</xccdf-1.2:description>
                  <xccdf-1.2:value>default</xccdf-1.2:value>
                  <xccdf-1.2:value selector="acos5">acos5</xccdf-1.2:value>
                  <xccdf-1.2:value selector="akis">akis</xccdf-1.2:value>
                  <xccdf-1.2:value selector="asepcos">asepcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="atrust-acos">atrust-acos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="authentic">authentic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="belpic">belpic</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cac">cac</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cardos">cardos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="coolkey">coolkey</xccdf-1.2:value>
                  <xccdf-1.2:value selector="cyberflex">cyberflex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="dnie">dnie</xccdf-1.2:value>
                  <xccdf-1.2:value selector="entersafe">entersafe</xccdf-1.2:value>
                  <xccdf-1.2:value selector="epass2003">epass2003</xccdf-1.2:value>
                  <xccdf-1.2:value selector="flex">flex</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gemsafeV1">gemsafeV1</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gids">gids</xccdf-1.2:value>
                  <xccdf-1.2:value selector="gpk">gpk</xccdf-1.2:value>
                  <xccdf-1.2:value selector="iasecc">iasecc</xccdf-1.2:value>
                  <xccdf-1.2:value selector="incrypto34">incrypto34</xccdf-1.2:value>
                  <xccdf-1.2:value selector="isoApplet">isoApplet</xccdf-1.2:value>
                  <xccdf-1.2:value selector="itacns">itacns</xccdf-1.2:value>
                  <xccdf-1.2:value selector="jpki">jpki</xccdf-1.2:value>
                  <xccdf-1.2:value selector="MaskTech">MaskTech</xccdf-1.2:value>
                  <xccdf-1.2:value selector="mcrd">mcrd</xccdf-1.2:value>
                  <xccdf-1.2:value selector="muscle">muscle</xccdf-1.2:value>
                  <xccdf-1.2:value selector="myeid">myeid</xccdf-1.2:value>
                  <xccdf-1.2:value selector="npa">npa</xccdf-1.2:value>
                  <xccdf-1.2:value selector="oberthur">oberthur</xccdf-1.2:value>
                  <xccdf-1.2:value selector="openpgp">openpgp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="other">None</xccdf-1.2:value>
                  <xccdf-1.2:value selector="PIV-II">PIV-II</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken_ecp">rutoken_ecp</xccdf-1.2:value>
                  <xccdf-1.2:value selector="rutoken">rutoken</xccdf-1.2:value>
                  <xccdf-1.2:value selector="sc-hsm">sc-hsm</xccdf-1.2:value>
                  <xccdf-1.2:value selector="setcos">setcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="starcos">starcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="tcos">tcos</xccdf-1.2:value>
                  <xccdf-1.2:value selector="westcos">westcos</xccdf-1.2:value>
                </xccdf-1.2:Value>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_package_opensc_installed" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Install the opensc Package For Multifactor Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">
The <html:code>opensc</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install opensc</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001953</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000376-GPOS-00161</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="package_opensc_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "opensc" ; then
    dnf install -y "opensc"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_opensc_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure opensc is installed
  package:
    name: opensc
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_opensc_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_opensc_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_opensc

class install_opensc {
  package { 'opensc':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_opensc_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=opensc
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_opensc_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "opensc"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-package_opensc_installed:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-package_opensc_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Install the pcsc-lite package</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The <html:code>pcsc-lite</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install pcsc-lite</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000377-VMM-001530</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">The pcsc-lite package must be installed if it is to be available for
multifactor authentication using smartcards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "pcsc-lite" ; then
    dnf install -y "pcsc-lite"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure pcsc-lite is installed
  package:
    name: pcsc-lite
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_pcsc-lite_installed
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_pcsc-lite_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_pcsc-lite

class install_pcsc-lite {
  package { 'pcsc-lite':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_pcsc-lite_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=pcsc-lite
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="package_pcsc-lite_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "pcsc-lite"
version = "*"
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-package_pcsc-lite_installed:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-package_pcsc-lite_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Enable the pcscd Service</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">
The <html:code>pcscd</html:code> service can be enabled with the following command:
<html:pre>$ sudo systemctl enable pcscd.service</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000377-VMM-001530</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="service_pcscd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'pcscd.service'
"$SYSTEMCTL_EXEC" start 'pcscd.service'
"$SYSTEMCTL_EXEC" enable 'pcscd.service'

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="service_pcscd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Enable service pcscd
  block:

    - name: Gather the package facts
      package_facts:
        manager: auto

    - name: Enable service pcscd
      service:
        name: pcscd
        enabled: 'yes'
        state: started
        masked: 'no'
      when:
        - '"pcsc-lite" in ansible_facts.packages'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_pcscd_enabled
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="service_pcscd_enabled" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include enable_pcscd

class enable_pcscd {
  service {'pcscd':
    enable =&gt; true,
    ensure =&gt; 'running',
  }
}
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-content-ref name="oval:ssg-service_pcscd_enabled:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-service_pcscd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Configure opensc Smart Card Drivers</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The OpenSC smart card tool can auto-detect smart card drivers; however,
setting the smart card drivers in use by your organization helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To configure the OpenSC driver, edit the <html:code>/etc/opensc.conf</html:code>
and add the following line into the file in the <html:code>app default</html:code> block,
so it will look like:

<html:pre>
app default {
   ...
   card_drivers = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;
}
</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Configuring the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="configure_opensc_card_drivers" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_smartcard_drivers="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>"



OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:card_drivers:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="configure_opensc_card_drivers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_cd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure smartcard driver block
  block:

    - name: Check if card_drivers is defined
      command: /usr/bin/opensc-tool -G app:default:card_drivers
      changed_when: false
      register: card_drivers

    - name: Configure opensc Smart Card Drivers
      command: |
        /usr/bin/opensc-tool -S app:default:card_drivers:{{ var_smartcard_drivers }}
      when:
        - card_drivers.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_cd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_opensc_card_drivers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-configure_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-configure_opensc_card_drivers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" selected="false" role="full" severity="medium">
                  <xccdf-1.2:title xml:lang="en-US">Force opensc To Use Defined Smart Card Driver</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The OpenSC smart card middleware can auto-detect smart card drivers; however by
forcing the smart card driver in use by your organization, opensc will no longer
autodetect or use other drivers unless specified. This helps to prevent
users from using unauthorized smart cards. The default smart card driver for this
profile is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/></html:code>.
To force the OpenSC driver, edit the <html:code>/etc/opensc.conf</html:code>.
Look for a line similar to:
<html:pre># force_card_driver = customcos;</html:pre>
and change it to:
<html:pre>force_card_driver = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>;</html:pre></xccdf-1.2:description>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000766</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000767</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000768</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000771</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000772</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000884</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1382</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1384</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">1386</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(1)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(2)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(3)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(4)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(6)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(7)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2(11)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.3</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000106-GPOS-00053</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000107-GPOS-00054</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000109-GPOS-00056</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00055</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00057</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000108-GPOS-00058</xccdf-1.2:reference>
                  <xccdf-1.2:reference href="">SRG-OS-000376-VMM-001520</xccdf-1.2:reference>
                  <xccdf-1.2:rationale xml:lang="en-US">Smart card login provides two-factor authentication stronger than
that provided by a username and password combination. Smart cards leverage PKI
(public key infrastructure) in order to provide and verify credentials.
Forcing the smart card driver in use by your organization helps to prevent
users from using unauthorized smart cards.</xccdf-1.2:rationale>
                  <xccdf-1.2:platform idref="cpe:/a:machine"/>
                  <xccdf-1.2:fix id="force_opensc_card_drivers" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_smartcard_drivers="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>"



OPENSC_TOOL="/usr/bin/opensc-tool"

if [ -f "${OPENSC_TOOL}" ]; then
    ${OPENSC_TOOL} -S app:default:force_card_driver:$var_smartcard_drivers
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                  <xccdf-1.2:fix id="force_opensc_card_drivers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_smartcard_drivers # promote to variable
  set_fact:
    var_smartcard_drivers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers" use="legacy"/>
  tags:
    - always

- name: Check existence of opensc conf
  stat:
    path: /etc/opensc-{{ ansible_architecture }}.conf
  register: opensc_conf_fcd
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Force smartcard driver block
  block:

    - name: Check if force_card_driver is defined
      command: /usr/bin/opensc-tool -G app:default:force_card_driver
      changed_when: false
      register: force_card_driver

    - name: Force opensc To Use Defined Smart Card Driver
      command: |
        /usr/bin/opensc-tool -S app:default:force_card_driver:{{ var_smartcard_drivers }}
      when:
        - force_card_driver.stdout != var_smartcard_drivers
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - opensc_conf_fcd.stat.exists
  tags:
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-2(1)
    - NIST-800-53-IA-2(11)
    - NIST-800-53-IA-2(2)
    - NIST-800-53-IA-2(3)
    - NIST-800-53-IA-2(4)
    - NIST-800-53-IA-2(6)
    - NIST-800-53-IA-2(7)
    - PCI-DSS-Req-8.3
    - configure_strategy
    - force_opensc_card_drivers
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                  <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                    <xccdf-1.2:check-export export-name="oval:ssg-var_smartcard_drivers:var:1" value-id="xccdf_org.ssgproject.content_value_var_smartcard_drivers"/>
                    <xccdf-1.2:check-content-ref name="oval:ssg-force_opensc_card_drivers:def:1" href="ssg-fedora-oval.xml"/>
                  </xccdf-1.2:check>
                  <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                    <xccdf-1.2:check-content-ref name="ocil:ssg-force_opensc_card_drivers_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                  </xccdf-1.2:check>
                </xccdf-1.2:Rule>
                </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-restrictions">
            <xccdf-1.2:title xml:lang="en-US">Protect Accounts by Restricting Password-Based Login</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Conventionally, Unix shell accounts are accessed by
providing a username and password to a login program, which tests
these values for correctness using the <html:code>/etc/passwd</html:code> and
<html:code>/etc/shadow</html:code> files. Password-based login is vulnerable to
guessing of weak passwords, and to sniffing and man-in-the-middle
attacks against passwords entered over a network or at an insecure
console. Therefore, mechanisms for accessing accounts by entering
usernames and passwords should be restricted to those which are
operationally necessary.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex" operator="pattern match" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Accounts Authorized Local Users on the Operating System</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">List the user accounts that are authorized locally on the operating system. This list
includes both users requried by the operating system and by the installed applications.
Depending on the Operating System distribution, version, software groups and applications,
the user list is different and can be customized with scap-workbench.
OVAL regular expression is used for the user list.
The list starts with '^' and ends with '$' so that it matches exactly the
username, not any string that includes the username. Users are separated with '|'.
For example, three users: bin, oracle and sapadm are allowd, then the list is
<html:code>^(bin|oracle|sapadm)$</html:code>. The user <html:code>root</html:code> is the only user that is hard coded
in OVAL that is always allowed on the operating system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="rhel7">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="rhel8">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="ol7forsap">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$</xccdf-1.2:value>
              <xccdf-1.2:value selector="saponol7">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|[a-z][a-z0-9][a-z0-9]adm|ora[a-z][a-z0-9][a-z0-9]|sapadm|oracle)$</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_account_expiration">
              <xccdf-1.2:title xml:lang="en-US">Set Account Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Accounts can be configured to be automatically disabled
after a certain time period,
meaning that they will require administrator interaction to become usable again.
Expiration of accounts after inactivity can be set for all accounts by default
and also on a per-account basis, such as for accounts that are known to be temporary.
To configure automatic expiration of an account following
the expiration of its password (that is, after the password has expired and not been changed),
run the following command, substituting <html:code><html:i>NUM_DAYS</html:i></html:code> and <html:code><html:i>USER</html:i></html:code> appropriately:
<html:pre>$ sudo chage -I <html:i>NUM_DAYS USER</html:i></html:pre>
Accounts, such as temporary accounts, can also be configured to expire on an explicitly-set date with the
<html:code>-E</html:code> option.
The file <html:code>/etc/default/useradd</html:code> controls
default settings for all newly-created accounts created with the system's
normal command line utilities.</xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" type="number">
                <xccdf-1.2:title xml:lang="en-US">number of days after a password expires until the account is permanently disabled</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The number of days to wait after a password expires, until the account will be permanently disabled.</xccdf-1.2:description>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="30">30</xccdf-1.2:value>
                <xccdf-1.2:value selector="35">35</xccdf-1.2:value>
                <xccdf-1.2:value selector="40">40</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>35</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Account Expiration Following Inactivity</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in <html:code>/etc/default/useradd</html:code>:
<html:pre>INACTIVE=<html:i><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:i></html:pre>
If a password is currently on the verge of expiration, then
<html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code>
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/></html:code> day(s) could
elapse until the account would be automatically disabled. See the
<html:code>useradd</html:code> man page for more information.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000017</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000795</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-4(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(3)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000118-GPOS-00060</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000003-VMM-000030</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000118-VMM-000590</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Disabling inactive accounts ensures that accounts which may not
have been responsibly removed are not available to attackers
who may have compromised their credentials.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:login_defs"/>
                <xccdf-1.2:fix id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_account_disable_post_pw_expiration="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>"



# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "/etc/default/useradd"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^INACTIVE")

# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_account_disable_post_pw_expiration"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^INACTIVE\\&gt;" "/etc/default/useradd"; then
    "${sed_command[@]}" "s/^INACTIVE\\&gt;.*/$formatted_output/gi" "/etc/default/useradd"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "/etc/default/useradd" &gt;&gt; "/etc/default/useradd"
    printf '%s\n' "$formatted_output" &gt;&gt; "/etc/default/useradd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="account_disable_post_pw_expiration" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_account_disable_post_pw_expiration # promote to variable
  set_fact:
    var_account_disable_post_pw_expiration: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration" use="legacy"/>
  tags:
    - always

- name: Set Account Expiration Following Inactivity
  lineinfile:
    create: true
    dest: /etc/default/useradd
    regexp: ^INACTIVE
    line: INACTIVE={{ var_account_disable_post_pw_expiration }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1.1
    - NIST-800-171-3.5.6
    - NIST-800-53-AC-2(3)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-4(e)
    - PCI-DSS-Req-8.1.4
    - account_disable_post_pw_expiration
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-account_disable_post_pw_expiration:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_account_unique_name" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure All Accounts on the System Have Unique Names</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Ensure accounts on the system have unique names.

To ensure all accounts have unique names, run the following command:
<html:pre>$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</html:pre>
If a username is returned, change or delete the username.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000770</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000804</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unique usernames allow for accountability on the system.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-account_unique_name:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-account_unique_name_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_expiration">
              <xccdf-1.2:title xml:lang="en-US">Set Password Expiration Parameters</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The file <html:code>/etc/login.defs</html:code> controls several
password-related settings. Programs such as <html:code>passwd</html:code>,
<html:code>su</html:code>, and
<html:code>login</html:code> consult <html:code>/etc/login.defs</html:code> to determine
behavior with regard to password aging, expiration warnings,
and length. See the man page <html:code>login.defs(5)</html:code> for more information.
<html:br/><html:br/>
Users should be forced to change their passwords, in order to
decrease the utility of compromised passwords. However, the need to
change passwords often should be balanced against the risk that
users will reuse or write down passwords if forced to change them
too often. Forcing password changes every 90-360 days, depending on
the environment, is recommended. Set the appropriate value as
<html:code>PASS_MAX_DAYS</html:code> and apply it to existing accounts with the
<html:code>-M</html:code> flag.
<html:br/><html:br/>
The <html:code>PASS_MIN_DAYS</html:code> (<html:code>-m</html:code>) setting prevents password
changes for 7 days after the first change, to discourage password
cycling. If you use this setting, train users to contact an administrator
for an emergency password change in case a new password becomes
compromised. The <html:code>PASS_WARN_AGE</html:code> (<html:code>-W</html:code>) setting gives
users 7 days of warnings at login time that their passwords are about to expire.
<html:br/><html:br/>
For example, for each existing human user <html:i>USER</html:i>, expiration parameters
could be adjusted to a 180 day maximum password age, 7 day minimum password
age, and 7 day warning period with the following command:
<html:pre>$ sudo chage -M 180 -m 7 -W 7 USER</html:pre></xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" type="number">
                <xccdf-1.2:title xml:lang="en-US">maximum password age</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Maximum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
                <xccdf-1.2:value selector="365">365</xccdf-1.2:value>
                <xccdf-1.2:value selector="120">120</xccdf-1.2:value>
                <xccdf-1.2:value selector="180">180</xccdf-1.2:value>
                <xccdf-1.2:value selector="60">60</xccdf-1.2:value>
                <xccdf-1.2:value selector="90">90</xccdf-1.2:value>
                <xccdf-1.2:value>60</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs" type="number">
                <xccdf-1.2:title xml:lang="en-US">minimum password age</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Minimum age of password in days</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
                <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
                <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs" type="number">
                <xccdf-1.2:title xml:lang="en-US">minimum password length</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Minimum number of characters in password</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This will only check new passwords</xccdf-1.2:warning>
                <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
                <xccdf-1.2:value selector="12">12</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
                <xccdf-1.2:value selector="18">18</xccdf-1.2:value>
                <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
                <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
                <xccdf-1.2:value selector="8">8</xccdf-1.2:value>
                <xccdf-1.2:value>15</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs" type="number">
                <xccdf-1.2:title xml:lang="en-US">warning days before password expires</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The number of days' warning given before a password expires.</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This will only apply to newly created accounts</xccdf-1.2:warning>
                <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="14">14</xccdf-1.2:value>
                <xccdf-1.2:value selector="7">7</xccdf-1.2:value>
                <xccdf-1.2:value>7</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Set Password Maximum Age</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To specify password maximum age for new accounts,
edit the file <html:code>/etc/login.defs</html:code>
and add or correct the following line:
<html:pre>PASS_MAX_DAYS <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:pre>
A value of 180 days is sufficient for many environments.
The DoD requirement is 60.
The profile requirement is <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/></html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R18)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000199</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0418</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1055</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1402</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(f)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000076-GPOS-00044</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
<html:br/><html:br/>
Setting the password maximum age ensures users are required to
periodically change their passwords. Requiring shorter password lifetimes
increases the risk of users writing down the password in a convenient
location subject to physical compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:login_defs"/>
                <xccdf-1.2:fix id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q login; then


var_accounts_maximum_age_login_defs="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>"



grep -q ^PASS_MAX_DAYS /etc/login.defs &amp;&amp; \
  sed -i "s/PASS_MAX_DAYS.*/PASS_MAX_DAYS     $var_accounts_maximum_age_login_defs/g" /etc/login.defs
if ! [ $? -eq 0 ]; then
    echo "PASS_MAX_DAYS      $var_accounts_maximum_age_login_defs" &gt;&gt; /etc/login.defs
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="accounts_maximum_age_login_defs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_accounts_maximum_age_login_defs # promote to variable
  set_fact:
    var_accounts_maximum_age_login_defs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs" use="legacy"/>
  tags:
    - always

- name: Set Password Maximum Age
  lineinfile:
    create: true
    dest: /etc/login.defs
    regexp: ^#?PASS_MAX_DAYS
    line: PASS_MAX_DAYS {{ var_accounts_maximum_age_login_defs }}
  when: '"login" in ansible_facts.packages'
  tags:
    - CJIS-5.6.2.1
    - NIST-800-171-3.5.6
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(d)
    - NIST-800-53-IA-5(f)
    - PCI-DSS-Req-8.2.4
    - accounts_maximum_age_login_defs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
                  <xccdf-1.2:check-content-ref name="oval:ssg-accounts_maximum_age_login_defs:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_password_storage">
              <xccdf-1.2:title xml:lang="en-US">Verify Proper Storage and Existence of Password
Hashes</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">By default, password hashes for local accounts are stored
in the second field (colon-separated) in
<html:code>/etc/shadow</html:code>. This file should be readable only by
processes running with root credentials, preventing users from
casually accessing others' password hashes and attempting
to crack them.
However, it remains possible to misconfigure the system
and store password hashes
in world-readable files such as <html:code>/etc/passwd</html:code>, or
to even store passwords themselves in plaintext on the system.
Using system-provided tools for password change/creation
should allow administrators to avoid such misconfiguration.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds" type="number">
                <xccdf-1.2:title xml:lang="en-US">Password Hashing algorithm</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Specify the number of SHA rounds for the system password encryption algorithm.
Defines the value set in <html:code>/etc/pam.d/system-auth</html:code> and <html:code>/etc/pam.d/password-auth</html:code></xccdf-1.2:description>
                <xccdf-1.2:value>5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="5000">5000</xccdf-1.2:value>
                <xccdf-1.2:value selector="65536">65536</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify All Account Password Hashes are Shadowed</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If any password hashes are stored in <html:code>/etc/passwd</html:code> (in the second field,
instead of an <html:code>x</html:code> or <html:code>*</html:code>), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.5.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">1410</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(h)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.1</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The hashes for all user account passwords should be stored in
the file <html:code>/etc/shadow</html:code> and never in <html:code>/etc/passwd</html:code>,
which is readable by all users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-accounts_password_all_shadowed:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" selected="false" role="full" severity="low">
                <xccdf-1.2:title xml:lang="en-US">All GIDs referenced in /etc/passwd must be defined in /etc/group</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Add a group to the system for each GID referenced without a corresponding group.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000764</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.5.a</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000104-GPOS-00051</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Gruop Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group.</xccdf-1.2:rationale>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_no_empty_passwords" selected="false" role="full" severity="high">
                <xccdf-1.2:title xml:lang="en-US">Prevent Login to Accounts With Empty Password</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If an account is configured for password authentication
but does not have an assigned password, it may be possible to log
into the account without authentication. Remove any instances of the
<html:code>nullok</html:code> in

<html:code>/etc/pam.d/system-auth</html:code>

to prevent logins with empty passwords.
Note that this rule is not applicable for systems running within a
container. Having user with empty password within a container is not
considered a risk, because it should not be possible to directly login into
a container anyway.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FIA_UAU.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:machine"/>
                <xccdf-1.2:fix id="no_empty_passwords" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' /etc/pam.d/system-auth
sed --follow-symlinks -i 's/\&lt;nullok\&gt;//g' /etc/pam.d/password-auth

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="no_empty_passwords" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Prevent Log In to Accounts With Empty Password - system-auth
  replace:
    dest: /etc/pam.d/system-auth
    regexp: nullok
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed

- name: Prevent Log In to Accounts With Empty Password - password-auth
  replace:
    dest: /etc/pam.d/password-auth
    regexp: nullok
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2
    - NIST-800-171-3.1.1
    - NIST-800-171-3.1.5
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)(a)
    - NIST-800-53-IA-5(c)
    - PCI-DSS-Req-8.2.3
    - configure_strategy
    - high_severity
    - low_complexity
    - medium_disruption
    - no_empty_passwords
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="no_empty_passwords" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/password-auth
        overwrite: true
      - contents:
          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
        mode: 0644
        path: /etc/pam.d/system-auth
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-no_empty_passwords:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-no_empty_passwords_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_logins">
              <xccdf-1.2:title xml:lang="en-US">Restrict Root Logins</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Direct root logins should be allowed only for emergency use.
In normal situations, the administrator should access the system
via a unique unprivileged account, and then use <html:code>su</html:code> or <html:code>sudo</html:code> to execute
privileged commands. Discouraging administrators from accessing the
root account directly ensures an audit trail in organizations with
multiple administrators. Locking down the channels through which
root can connect directly also reduces opportunities for
password-guessing against the root account. The <html:code>login</html:code> program
uses the file <html:code>/etc/securetty</html:code> to determine which interfaces
should allow root logins.

The virtual devices <html:code>/dev/console</html:code>
and <html:code>/dev/tty*</html:code> represent the system consoles (accessible via
the Ctrl-Alt-F1 through Ctrl-Alt-F6 keyboard sequences on a default
installation). The default securetty file also contains <html:code>/dev/vc/*</html:code>.
These are likely to be deprecated in most environments, but may be retained
for compatibility. Root should also be prohibited from connecting
via network protocols. Other sections of this document
include guidance describing how to prevent root from logging in via SSH.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_accounts-session">
            <xccdf-1.2:title xml:lang="en-US">Secure Session Configuration Files for Login Accounts</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">When a user logs into a Unix account, the system
configures the user's session by reading a number of files. Many of
these files are located in the user's home directory, and may have
weak permissions as a result of user error or misconfiguration. If
an attacker can modify or even read certain types of account
configuration information, they can often gain full access to the
affected user's account. Therefore, it is important to test and
correct configuration file permissions for interactive accounts,
particularly those of privileged users such as root or system
administrators.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_fail_delay" type="number">
              <xccdf-1.2:title xml:lang="en-US">Maximum login attempts delay</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Maximum time in seconds between fail login attempts before re-prompting.</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>4</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions" type="number">
              <xccdf-1.2:title xml:lang="en-US">Maximum concurrent login sessions</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Maximum number of concurrent sessions by a user</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="15">15</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value>1</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_tmout" type="number">
              <xccdf-1.2:title xml:lang="en-US">Account Inactivity Timeout (minutes)</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">In an interactive shell, the value is interpreted as the
number of seconds to wait for input after issuing the primary prompt.
Bash terminates after waiting for that number of seconds if input does
not arrive.</xccdf-1.2:description>
              <xccdf-1.2:value selector="30_min">1800</xccdf-1.2:value>
              <xccdf-1.2:value selector="10_min">600</xccdf-1.2:value>
              <xccdf-1.2:value selector="15_min">900</xccdf-1.2:value>
              <xccdf-1.2:value selector="5_min">300</xccdf-1.2:value>
              <xccdf-1.2:value>600</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_root_paths">
              <xccdf-1.2:title xml:lang="en-US">Ensure that No Dangerous Directories Exist in Root's Path</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The active path of the root account can be obtained by
starting a new root shell and running:
<html:pre># echo $PATH</html:pre>
This will produce a colon-separated list of
directories in the path.
<html:br/><html:br/>
Certain path elements could be considered dangerous, as they could lead
to root executing unknown or
untrusted programs, which could contain malicious
code.
Since root may sometimes work inside
untrusted directories, the <html:code>.</html:code> character, which represents the
current directory, should never be in the root path, nor should any
directory which can be written to by an unprivileged or
semi-privileged (system) user.
<html:br/><html:br/>
It is a good practice for administrators to always execute
privileged commands by typing the full path to the
command.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_user_umask">
              <xccdf-1.2:title xml:lang="en-US">Ensure that Users Have Sensible Umask Values</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The umask setting controls the default permissions
for the creation of new files.
With a default <html:code>umask</html:code> setting of 077, files and directories
created by users will not be readable by any other user on the
system. Users who wish to make specific files group- or
world-readable can accomplish this by using the chmod command.
Additionally, users can make all their files readable to their
group by default by setting a <html:code>umask</html:code> of 027 in their shell
configuration files. If default per-user groups exist (that is, if
every user has a default group whose name is the same as that
user's username and whose only member is the user), then it may
even be safe for users to select a <html:code>umask</html:code> of 007, making it very
easy to intentionally share files with groups of which the user is
a member.
<html:br/><html:br/></xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_accounts_user_umask" type="string">
                <xccdf-1.2:title xml:lang="en-US">Sensible umask</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enter default user umask</xccdf-1.2:description>
                <xccdf-1.2:value selector="007">007</xccdf-1.2:value>
                <xccdf-1.2:value selector="022">022</xccdf-1.2:value>
                <xccdf-1.2:value selector="027">027</xccdf-1.2:value>
                <xccdf-1.2:value selector="077">077</xccdf-1.2:value>
                <xccdf-1.2:value>027</xccdf-1.2:value>
              </xccdf-1.2:Value>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditing">
          <xccdf-1.2:title xml:lang="en-US">System Accounting with auditd</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The audit service provides substantial capabilities
for recording system activities. By default, the service audits about
SELinux AVC denials and certain types of security-relevant events
such as system logins, account modifications, and authentication
events performed by programs such as sudo.
Under its default configuration, <html:code>auditd</html:code> has modest disk space
requirements, and should not noticeably impact system performance.
<html:br/><html:br/>
NOTE: The Linux Audit daemon <html:code>auditd</html:code> can be configured to use
the <html:code>augenrules</html:code> program to read audit rules files (<html:code>*.rules</html:code>)
located in <html:code>/etc/audit/rules.d</html:code> location and compile them to create
the resulting form of the <html:code>/etc/audit/audit.rules</html:code> configuration file
during the daemon startup (default configuration). Alternatively, the <html:code>auditd</html:code>
daemon can use the <html:code>auditctl</html:code> utility to read audit rules from the
<html:code>/etc/audit/audit.rules</html:code> configuration file during daemon startup,
and load them into the kernel. The expected behavior is configured via the
appropriate <html:code>ExecStartPost</html:code> directive setting in the
<html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
To instruct the <html:code>auditd</html:code> daemon to use the <html:code>augenrules</html:code> program
to read audit rules (default configuration), use the following setting:
<html:br/> <html:pre>ExecStartPost=-/sbin/augenrules --load</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
In order to instruct the <html:code>auditd</html:code> daemon to use the <html:code>auditctl</html:code>
utility to read audit rules, use the following setting:
<html:br/> <html:pre>ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules</html:pre>
in the <html:code>/usr/lib/systemd/system/auditd.service</html:code> configuration file.
Refer to <html:code>[Service]</html:code> section of the <html:code>/usr/lib/systemd/system/auditd.service</html:code>
configuration file for further details.
<html:br/><html:br/>
Government networks often have substantial auditing
requirements and <html:code>auditd</html:code> can be configured to meet these
requirements.
Examining some example audit records demonstrates how the Linux audit system
satisfies common requirements.
The following example from Fedora Documentation available at
<html:code><html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/selinux_users_and_administrators_guide/index#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages</html:a></html:code>
shows the substantial amount of information captured in a
two typical "raw" audit messages, followed by a breakdown of the most important
fields. In this example the message is SELinux-related and reports an AVC
denial (and the associated system call) that occurred when the Apache HTTP
Server attempted to access the <html:code>/var/www/html/file1</html:code> file (labeled with
the <html:code>samba_share_t</html:code> type):
<html:pre>type=AVC msg=audit(1226874073.147:96): avc:  denied  { getattr } for pid=2465 comm="httpd"
path="/var/www/html/file1" dev=dm-0 ino=284133 scontext=unconfined_u:system_r:httpd_t:s0
tcontext=unconfined_u:object_r:samba_share_t:s0 tclass=file

type=SYSCALL msg=audit(1226874073.147:96): arch=40000003 syscall=196 success=no exit=-13
a0=b98df198 a1=bfec85dc a2=54dff4 a3=2008171 items=0 ppid=2463 pid=2465 auid=502 uid=48
gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=6 comm="httpd"
exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)
</html:pre>
<html:ul><html:li><html:code>msg=audit(1226874073.147:96)</html:code><html:ul><html:li>The number in parentheses is the unformatted time stamp (Epoch time)
for the event, which can be converted to standard time by using the
<html:code>date</html:code> command.
</html:li></html:ul></html:li><html:li><html:code>{ getattr }</html:code><html:ul><html:li>The item in braces indicates the permission that was denied. <html:code>getattr</html:code>
indicates the source process was trying to read the target file's status information.
This occurs before reading files. This action is denied due to the file being
accessed having the wrong label. Commonly seen permissions include <html:code>getattr</html:code>,
<html:code>read</html:code>, and <html:code>write</html:code>.</html:li></html:ul></html:li><html:li><html:code>comm="httpd"</html:code><html:ul><html:li>The executable that launched the process. The full path of the executable is
found in the <html:code>exe=</html:code> section of the system call (<html:code>SYSCALL</html:code>) message,
which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul></html:li><html:li><html:code>path="/var/www/html/file1"</html:code><html:ul><html:li>The path to the object (target) the process attempted to access.
</html:li></html:ul></html:li><html:li><html:code>scontext="unconfined_u:system_r:httpd_t:s0"</html:code><html:ul><html:li>The SELinux context of the process that attempted the denied action. In
this case, it is the SELinux context of the Apache HTTP Server, which is running
in the <html:code>httpd_t</html:code> domain.
</html:li></html:ul></html:li><html:li><html:code>tcontext="unconfined_u:object_r:samba_share_t:s0"</html:code><html:ul><html:li>The SELinux context of the object (target) the process attempted to access.
In this case, it is the SELinux context of <html:code>file1</html:code>. Note: the <html:code>samba_share_t</html:code>
type is not accessible to processes running in the <html:code>httpd_t</html:code> domain.</html:li></html:ul></html:li><html:li> From the system call (<html:code>SYSCALL</html:code>) message, two items are of interest:
<html:ul><html:li><html:code>success=no</html:code>: indicates whether the denial (AVC) was enforced or not.
<html:code>success=no</html:code> indicates the system call was not successful (SELinux denied
access). <html:code>success=yes</html:code> indicates the system call was successful - this can
be seen for permissive domains or unconfined domains, such as <html:code>initrc_t</html:code>
and <html:code>kernel_t</html:code>.
</html:li><html:li><html:code>exe="/usr/sbin/httpd"</html:code>: the full path to the executable that launched
the process, which in this case, is <html:code>exe="/usr/sbin/httpd"</html:code>.
</html:li></html:ul>
</html:li></html:ul></xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Install audispd-plugins Package</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>audispd-plugins</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install audispd-plugins</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FMT_SMF_EXT.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US"><html:code>audispd-plugins</html:code> provides plugins for the real-time interface to the
audit subsystem, <html:code>audispd</html:code>. These plugins can do things like relay events
to remote machines or analyze events for suspicious behavior.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:fix id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if ! rpm -q --quiet "audispd-plugins" ; then
    dnf install -y "audispd-plugins"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure audispd-plugins is installed
  package:
    name: audispd-plugins
    state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_audispd-plugins_installed
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="package_audispd-plugins_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_audispd-plugins

class install_audispd-plugins {
  package { 'audispd-plugins':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="package_audispd-plugins_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=audispd-plugins
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="package_audispd-plugins_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "audispd-plugins"
version = "*"
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-package_audispd-plugins_installed:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref name="ocil:ssg-package_audispd-plugins_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Enable Auditing for Processes Which Start Prior to the Audit Daemon</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">To ensure all processes can be audited, even those which start
prior to the audit daemon, add the argument <html:code>audit=1</html:code> to the default
GRUB 2 command line for the Linux operating system in

<html:code>/boot/grub2/grubenv</html:code>, in the manner below:
<html:pre># grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) audit=1"</html:pre></xccdf-1.2:description>
            <xccdf-1.2:warning xml:lang="en-US" category="management">The GRUB 2 configuration file, <html:code>grub.cfg</html:code>,
is automatically updated each time a new kernel is installed. Note that any
changes to <html:code>/etc/default/grub</html:code> require rebuilding the <html:code>grub.cfg</html:code>
file. To update the GRUB 2 configuration file manually, use the
<html:pre>grub2-mkconfig -o</html:pre> command as follows:
<html:ul><html:li>On BIOS-based machines, issue the following command as <html:code>root</html:code>:
<html:pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</html:pre></html:li><html:li>On UEFI-based machines, issue the following command as <html:code>root</html:code>:

<html:pre>~]# grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg</html:pre></html:li></html:ul></xccdf-1.2:warning>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001464</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-14(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IR-5(1)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000473-GPOS-00218</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000254-GPOS-00095</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000254-VMM-000880</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US">Each process on the system carries an "auditable" flag which indicates whether
its activities can be audited. Although <html:code>auditd</html:code> takes care of enabling
this for all processes which launch after it does, adding the kernel argument
ensures it is set for every process during boot.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:grub2"/>
            <xccdf-1.2:fix id="grub2_audit_argument" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ] &amp;&amp; { rpm --quiet -q grub2-common; }; then

# Correct grub2 kernelopts value using grub2-editenv
existing_kernelopts="$(grub2-editenv - list | grep kernelopts)"
if ! printf '%s' "$existing_kernelopts" | grep -qE '^kernelopts=(.*\s)?audit=1(\s.*)?$'; then
  if test -n "$existing_kernelopts"; then
    grub2-editenv - set "$existing_kernelopts audit=1"
  else
    grub2-editenv - set "kernelopts=audit=1"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="grub2_audit_argument" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="medium" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: get current kernel parameters
  ansible.builtin.shell:
    cmd: /usr/bin/grub2-editenv - list | grep "kernelopts="
  register: kernelopts
  changed_when: false
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Update the bootloader menu
  command: /usr/bin/grub2-editenv - set "{{ item }} audit=1"
  with_items: '{{ kernelopts.stdout_lines | select(''match'', ''^kernelopts.*'') |
    list }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '"grub2-common" in ansible_facts.packages'
    - kernelopts.stdout_lines is defined
    - kernelopts.stdout_lines | length &gt; 0
    - kernelopts.stdout | regex_search('^kernelopts=(?:.*\s)?audit=1(?:\s.*)?$', multiline=True)
      is none
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AC-17(1)
    - NIST-800-53-AU-10
    - NIST-800-53-AU-14(1)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IR-5(1)
    - PCI-DSS-Req-10.3
    - grub2_audit_argument
    - low_disruption
    - medium_complexity
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-grub2_audit_argument:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref name="ocil:ssg-grub2_audit_argument_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_auditd_configure_rules">
            <xccdf-1.2:title xml:lang="en-US">Configure auditd Rules for Comprehensive Auditing</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section describes recommended
configuration settings for comprehensive auditing, but a full
description of the auditing system's capabilities is beyond the
scope of this guide. The mailing list <html:i>linux-audit@redhat.com</html:i> exists
to facilitate community discussion of the auditing system.
<html:br/><html:br/>
The audit subsystem supports extensive collection of events, including:
<html:br/>
<html:ul><html:li>Tracing of arbitrary system calls (identified by name or number)
on entry or exit.</html:li><html:li>Filtering by PID, UID, call success, system call argument (with
some limitations), etc.</html:li><html:li>Monitoring of specific files for modifications to the file's
contents or metadata.</html:li></html:ul>
<html:br/>
Auditing rules at startup are controlled by the file <html:code>/etc/audit/audit.rules</html:code>.
Add rules to it to meet the auditing requirements for your organization.
Each line in <html:code>/etc/audit/audit.rules</html:code> represents a series of arguments
that can be passed to <html:code>auditctl</html:code> and can be individually tested
during runtime. See documentation in <html:code>/usr/share/doc/audit-<html:i>VERSION</html:i></html:code> and
in the related man pages for more details.
<html:br/><html:br/>
If copying any example audit rulesets from <html:code>/usr/share/doc/audit-VERSION</html:code>,
be sure to comment out the
lines containing <html:code>arch=</html:code> which are not appropriate for your system's
architecture. Then review and understand the following rules,
ensuring rules are activated as needed for the appropriate
architecture.
<html:br/><html:br/>
After reviewing all the rules, reading the following sections, and
editing as needed, the new rules can be activated as follows:
<html:pre>$ sudo service auditd restart</html:pre></xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:audit"/>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_immutable" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Make the auditd Configuration Immutable</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file in order to make the auditd configuration
immutable:
<html:pre>-e 2</html:pre>
With this setting, a reboot will be required to change any audit rules.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iv)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Making the audit configuration immutable prevents accidental as
well as malicious modification of the audit rules, although it may be
problematic if legitimate changes are needed during system
operation</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_immutable" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Traverse all of:
#
# /etc/audit/audit.rules,			(for auditctl case)
# /etc/audit/rules.d/*.rules			(for augenrules case)
#
# files to check if '-e .*' setting is present in that '*.rules' file already.
# If found, delete such occurrence since auditctl(8) manual page instructs the
# '-e 2' rule should be placed as the last rule in the configuration
find /etc/audit /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -exec sed -i '/-e[[:space:]]\+.*/d' {} ';'

# Append '-e 2' requirement at the end of both:
# * /etc/audit/audit.rules file 		(for auditctl case)
# * /etc/audit/rules.d/immutable.rules		(for augenrules case)

for AUDIT_FILE in "/etc/audit/audit.rules" "/etc/audit/rules.d/immutable.rules"
do
	echo '' &gt;&gt; $AUDIT_FILE
	echo '# Set the audit.rules configuration immutable per security requirements' &gt;&gt; $AUDIT_FILE
	echo '# Reboot is required to change audit rules once this setting is applied' &gt;&gt; $AUDIT_FILE
	echo '-e 2' &gt;&gt; $AUDIT_FILE
	chmod o-rwx $AUDIT_FILE
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_immutable" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Collect all files from /etc/audit/rules.d with .rules extension
  find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Remove the -e option from all Audit config files
  lineinfile:
    path: '{{ item }}'
    regexp: ^\s*(?:-e)\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add Audit -e option into /etc/audit/rules.d/immutable.rules and /etc/audit/audit.rules
  lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    mode: o-rwx
  loop:
    - /etc/audit/audit.rules
    - /etc/audit/rules.d/immutable.rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-171-3.4.3
    - NIST-800-53-AC-6(9)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.2
    - audit_rules_immutable
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_immutable" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-e%202%0A
        mode: 0600
        path: /etc/audit/rules.d/90-immutable.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_immutable:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Mandatory Access Controls</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/selinux/ -p wa -k MAC-policy</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The system's mandatory access policy (SELinux) should not be
arbitrarily changed by anything other than administrator action. All changes to
MAC policy should be audited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_mac_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/MAC-policy.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/selinux/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/MAC-policy.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/MAC-policy.rules"
    # If the MAC-policy.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/selinux/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/selinux/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/selinux/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/selinux/ -p wa -k MAC-policy" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_mac_modification" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key MAC-policy
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)MAC-policy$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/MAC-policy.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/MAC-policy.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/selinux/ -p wa -k MAC-policy
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /etc/selinux/ already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /etc/selinux/ in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/selinux/ -p wa -k MAC-policy
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.8
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_mac_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_mac_modification" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/selinux/%20-p%20wa%20-k%20MAC-policy%0A
        mode: 0600
        path: /etc/audit/rules.d/75-etcselinux-wa-MAC-policy.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_mac_modification:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_media_export" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects Information on Exporting to Media (successful)</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect media exportation
events for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S mount -F auid&gt;=1000 -F auid!=unset -F key=export</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The unauthorized exportation of data to external media could result in an information leak
where classified information, Privacy Act information, and intellectual property could be lost. An audit
trail should be created each time a filesystem is mounted to help identify and guard against information
loss.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_media_export" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="mount"
	KEY="perm_mod"
	SYSCALL_GROUPING=""

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_media_export" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit mount tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for mount for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - mount
        syscall_grouping: []

    - name: Check existence of mount in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_media_export
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_media_export:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Network Environment</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S sethostname,setdomainname -F key=audit_rules_networkconfig_modification
-w /etc/issue -p wa -k audit_rules_networkconfig_modification
-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
-w /etc/hosts -p wa -k audit_rules_networkconfig_modification
-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The network environment should not be modified by anything other
than administrator action. Any change to network parameters should be
audited.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="sethostname setdomainname"
	KEY="audit_rules_networkconfig_modification"
	SYSCALL_GROUPING="sethostname setdomainname"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

# Then perform the remediations for the watch rules
# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/issue" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/issue.net" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/issue.net" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/issue.net $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/issue.net$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/issue.net -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/hosts" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/hosts" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/hosts $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/hosts$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/hosts -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sysconfig/network" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_networkconfig_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
    # If the audit_rules_networkconfig_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sysconfig/network" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sysconfig/network $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sysconfig/network$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_networkconfig_modification" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Remediate audit rules for network configuration for x86_64
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_rules_networkconfig_modification.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - sethostname
          - setdomainname
        syscall_grouping:
          - sethostname
          - setdomainname

    - name: Check existence of sethostname, setdomainname in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_rules_networkconfig_modification
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/issue.net already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/issue.net\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/issue.net in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/issue.net -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/hosts already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/hosts\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/hosts in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/hosts -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_rules_networkconfig_modification
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_rules_networkconfig_modification$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_rules_networkconfig_modification.rules as the
    recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_networkconfig_modification.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/sysconfig/network already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/sysconfig/network\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/sysconfig/network in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/sysconfig/network -p wa -k audit_rules_networkconfig_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_networkconfig_modification
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_networkconfig_modification:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_session_events" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter Process and Session Initiation Information</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The audit system already collects process information for all
users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for attempted manual
edits of files involved in storing such process information:
<html:pre>-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_session_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/utmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/run/utmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/utmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/utmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/utmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/btmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/btmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/btmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/btmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/btmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/session.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/wtmp" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/session.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/session.rules"
    # If the session.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/wtmp" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/wtmp $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/wtmp$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/wtmp -p wa -k session" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_session_events" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/run/utmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/run/utmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/run/utmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/run/utmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/run/utmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/btmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/btmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/btmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/btmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/btmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key session
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)session$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use /etc/audit/rules.d/session.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/session.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /var/log/wtmp -p wa -k session
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Check if watch rule for /var/log/wtmp already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/var/log/wtmp\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Add watch rule for /var/log/wtmp in /etc/audit/audit.rules
  lineinfile:
    line: -w /var/log/wtmp -p wa -k session
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.3
    - audit_rules_session_events
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_session_events" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---


apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%0A-w%20/var/run/utmp%20-p%20wa%20-k%20session%0A-w%20/var/log/btmp%20-p%20wa%20-k%20session%0A-w%20/var/log/wtmp%20-p%20wa%20-k%20session%0A
        mode: 0600
        path: /etc/audit/rules.d/75-audit-session-events.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_session_events:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects System Administrator Actions</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect administrator actions
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/sudoers -p wa -k actions
-w /etc/sudoers.d/ -p wa -k actions</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000135</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(7)(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5.b</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000462-VMM-001840</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sudoers" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/actions.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/sudoers.d/" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/actions.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/actions.rules"
    # If the actions.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/sudoers.d/" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/sudoers.d/ $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/sudoers.d/$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/sudoers.d/ -p wa -k actions" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for audit rule entries for sysadmin actions
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*/etc/sudoers.*$
    patterns: '*.rules'
  register: find_audit_sysadmin_actions
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/actions.rules as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - /etc/audit/rules.d/actions.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_sysadmin_actions_files:
      - '{{ find_audit_sysadmin_actions.files | map(attribute=''path'') | list | first
        }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_audit_sysadmin_actions.matched is defined and find_audit_sysadmin_actions.matched
      &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d rule in rules.d
  lineinfile:
    path: '{{ all_sysadmin_actions_files[0] }}'
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces audit rule for /etc/sudoers.d in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -w /etc/sudoers.d/ -p wa -k actions
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(7)(b)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - PCI-DSS-Req-10.2.5.b
    - audit_rules_sysadmin_actions
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_sysadmin_actions" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/sudoers.d/%20-p%20wa%20-k%20actions%0A-w%20/etc/sudoers%20-p%20wa%20-k%20actions%0A
        mode: 0600
        path: /etc/audit/rules.d/75-audit-sysadmin-actions.rules
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_sysadmin_actions:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify User/Group Information - /etc/group</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/group -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">CCI-002884</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/group" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/group" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/group $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/group$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/group -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_group" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit group tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_group
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_group.matched is defined and find_group.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_group.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_group.matched is defined and find_group.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the group rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/group -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_group
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_usergroup_modification_group:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify User/Group Information - /etc/gshadow</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/gshadow -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/gshadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/gshadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/gshadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/gshadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/gshadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_gshadow" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit gshadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_gshadow
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_gshadow.matched is defined and find_gshadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_gshadow.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_gshadow.matched is defined and find_gshadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the gshadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/gshadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_gshadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_gshadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify User/Group Information - /etc/security/opasswd</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/security/opasswd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/security/opasswd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/security/opasswd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/security/opasswd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_opasswd" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit opasswd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_opasswd
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_opasswd.matched is defined and find_opasswd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_opasswd.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_opasswd.matched is defined and find_opasswd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the opasswd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/security/opasswd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_opasswd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_opasswd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify User/Group Information - /etc/passwd</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/passwd -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000274-GPOS-00104</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000275-GPOS-00105</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000276-GPOS-00106</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000277-GPOS-00107</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/passwd" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/passwd" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/passwd $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/passwd$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/passwd -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_passwd" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit passwd tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_passwd
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_passwd.matched is defined and find_passwd.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_passwd.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_passwd.matched is defined and find_passwd.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the passwd rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/passwd -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify User/Group Information - /etc/shadow</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file, in order to capture events that modify
account changes:
<html:br/><html:br/>
<html:pre>-w /etc/shadow -p wa -k audit_rules_usergroup_modification</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000018</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001403</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001404</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001683</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001684</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001685</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001686</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002132</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000004-GPOS-00004</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000470-GPOS-00214</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000239-GPOS-00089</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000240-GPOS-00090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000241-GPOS-00091</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000303-GPOS-00120</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000304-GPOS-00121</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000476-GPOS-00221</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000004-VMM-000040</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000239-VMM-000810</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000240-VMM-000820</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000241-VMM-000830</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000274-VMM-000960</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000275-VMM-000970</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000276-VMM-000980</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000277-VMM-000990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000303-VMM-001090</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000304-VMM-001100</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000476-VMM-001960</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">In addition to auditing new user and group accounts, these watches
will alert the system administrator(s) to any modifications. Any unexpected
users, groups, or modifications should be investigated for legitimacy.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/shadow" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_rules_usergroup_modification.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_rules_usergroup_modification.rules"
    # If the audit_rules_usergroup_modification.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/shadow" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/shadow $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/shadow$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/shadow -p wa -k audit_rules_usergroup_modification" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="audit_rules_usergroup_modification_shadow" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit shadow tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Search /etc/audit/rules.d for other user/group modification audit rules
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: -k audit_rules_usergroup_modification$
    patterns: '*.rules'
  register: find_shadow
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: If existing user/group modification ruleset not found, use /etc/audit/rules.d/privileged.rules
    as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/privileged.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_shadow.matched is defined and find_shadow.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_shadow.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_shadow.matched is defined and find_shadow.matched &gt; 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in rules.d when on x86
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Inserts/replaces the shadow rule in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/shadow -p wa -k audit_rules_usergroup_modification
    state: present
    dest: /etc/audit/audit.rules
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.5
    - audit_rules_usergroup_modification_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_usergroup_modification_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">System Audit Logs Must Be Owned By Root</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">All audit logs must be owned by root user and group. By default, the path for audit log is <html:pre>/var/log/audit/</html:pre>.

To properly set the owner of <html:code>/var/log/audit</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit </html:pre>

To properly set the owner of <html:code>/var/log/audit/*</html:code>, run the command:
<html:pre>$ sudo chown root /var/log/audit/* </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="file_ownership_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chown root.${GROUP} /var/log/audit
    chown root.${GROUP} /var/log/audit/audit.log*
  else
    chown root.root /var/log/audit
    chown root.root /var/log/audit/audit.log*
  fi
else
  chown root.root /var/log/audit
  chown root.root /var/log/audit/audit.log*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-file_ownership_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">System Audit Logs Must Have Mode 0640 or Less Permissive</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If <html:code>log_group</html:code> in <html:code>/etc/audit/auditd.conf</html:code> is set to a group other than the <html:code>root</html:code>
group account, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0640 <html:i>audit_file</html:i></html:pre>
<html:br/>
Otherwise, change the mode of the audit log files with the following command:
<html:pre>$ sudo chmod 0600 <html:i>audit_file</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000162</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000163</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000164</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-9(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000057-GPOS-00027</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000058-GPOS-00028</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000059-GPOS-00029</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000206-GPOS-00084</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">If users can write to audit logs, audit trails can be modified or destroyed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="file_permissions_var_log_audit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then
  GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
  if ! [ "${GROUP}" == 'root' ] ; then
    chmod 0640 /var/log/audit/audit.log
    chmod 0440 /var/log/audit/audit.log.*
  else
    chmod 0600 /var/log/audit/audit.log
    chmod 0400 /var/log/audit/audit.log.*
  fi
else
  chmod 0600 /var/log/audit/audit.log
  chmod 0400 /var/log/audit/audit.log.*
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-file_permissions_var_log_audit:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_dac_actions">
              <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S chown,fchown,fchownat,lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod
    -a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chmod</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_chmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of chmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_chmod:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - chown</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S chown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect.  Here the system calls
have been placed independent of other system calls.  Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="chown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_chown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit chown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for chown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - chown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of chown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_chown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_chown:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmod</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmod -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmod"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchmod" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmod tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmod for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmod
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmod in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmod
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmod:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchmodat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured to
use the <html:code>augenrules</html:code> program to read audit rules during daemon startup
(the default), add the following line to a file with suffix <html:code>.rules</html:code> in
the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchmodat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchmodat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chmod fchmod fchmodat"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchmodat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchmodat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchmodat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchmodat
        syscall_grouping:
          - chmod
          - fchmod
          - fchmodat

    - name: Check existence of fchmodat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchmodat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchown</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>

If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fchown:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fchownat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fchownat -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fchownat"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fchownat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fchownat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fchownat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fchownat
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of fchownat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fchownat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fchownat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - fsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S fsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="fsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_fsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit fsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for fsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - fsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of fsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_fsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lchown</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lchown -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lchown"
	KEY="perm_mod"
	SYSCALL_GROUPING="chown fchown fchownat lchown"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lchown" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lchown tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lchown for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lchown
        syscall_grouping:
          - chown
          - fchown
          - fchownat
          - lchown

    - name: Check existence of lchown in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lchown
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_lchown:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lremovexattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lremovexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lremovexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lremovexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lremovexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lremovexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lremovexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lremovexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lremovexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - lsetxattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S lsetxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="lsetxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_lsetxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit lsetxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for lsetxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - lsetxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of lsetxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_lsetxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - removexattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root.
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add the
following line to a file with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
<html:br/><html:br/>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S removexattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000463-GPOS-00207</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000474-GPOS-00219</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="removexattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_removexattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit removexattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for removexattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - removexattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of removexattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_removexattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_removexattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Events that Modify the System's Discretionary Access Controls - setxattr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file permission
changes for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S setxattr -F auid&gt;=1000 -F auid!=unset -F key=perm_mod</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000126</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000474-VMM-001940</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="setxattr"
	KEY="perm_mod"
	SYSCALL_GROUPING="fremovexattr lremovexattr removexattr fsetxattr lsetxattr setxattr"

	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_dac_modification_setxattr" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit setxattr tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for setxattr for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/perm_mod.rules
      set_fact: audit_file="/etc/audit/rules.d/perm_mod.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - setxattr
        syscall_grouping:
          - fremovexattr
          - lremovexattr
          - removexattr
          - fsetxattr
          - lsetxattr
          - setxattr

    - name: Check existence of setxattr in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=perm_mod
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.5
    - audit_rules_dac_modification_setxattr
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_dac_modification_setxattr:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_acl_commands">
              <xccdf-1.2:title xml:lang="en-US">Record Execution Attempts to Run ACL Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect the execution of
ACL privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_execution_selinux_commands">
              <xccdf-1.2:title xml:lang="en-US">Record Execution Attempts to Run SELinux Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect the execution of
SELinux privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_deletion_events">
              <xccdf-1.2:title xml:lang="en-US">Record File Deletion Events by User</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - rename</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rename -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rename"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_rename" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit rename tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rename for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rename
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rename in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rename
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rename:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_rename_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - renameat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S renameat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="renameat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_renameat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit renameat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for renameat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - renameat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of renameat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_renameat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - rmdir</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S rmdir -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_rmdir" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="rmdir"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_rmdir" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit rmdir tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for rmdir for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - rmdir
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of rmdir in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_rmdir
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_rmdir_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlink</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlink -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlink"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_unlink" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlink tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlink for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlink
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlink in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlink
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlink_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects File Deletion Events by User - unlinkat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect file deletion events
for all users and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file, setting ARCH to either b32 or b64 as
appropriate for your system:
<html:pre>-a always,exit -F arch=ARCH -S unlinkat -F auid&gt;=1000 -F auid!=unset -F key=delete</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000466-GPOS-00210</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000467-GPOS-00211</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000468-GPOS-00212</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000466-VMM-001870</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000468-VMM-001890</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
	SYSCALL="unlinkat"
	KEY="delete"
	SYSCALL_GROUPING="unlink unlinkat rename renameat rmdir"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_file_deletion_events_unlinkat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit unlinkat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for unlinkat for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/delete.rules
      set_fact: audit_file="/etc/audit/rules.d/delete.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - unlinkat
        syscall_grouping:
          - unlink
          - unlinkat
          - rename
          - renameat
          - rmdir

    - name: Check existence of unlinkat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F auid&gt;=1000 -F auid!=unset (?:-k
          |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F auid&gt;=1000
          -F auid!=unset -F key=delete
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.7
    - audit_rules_file_deletion_events_unlinkat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_file_deletion_events_unlinkat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_file_modification">
              <xccdf-1.2:title xml:lang="en-US">Record Unauthorized Access Attempts Events to Files (unsuccessful)</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. Note that the "-F arch=b32" lines should be
present even on a 64 bit system. These commands identify system calls for
auditing. Even if the system is 64 bit it can still execute 32 bit system
calls. Additionally, these rules can be configured in a number of ways while
still achieving the desired effect. An example of this is that the "-S" calls
could be split up and placed on separate lines, however, this is less efficient.
Add the following to <html:code>/etc/audit/audit.rules</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b32 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If your system is 64 bit then these lines should be duplicated and the
arch=b32 replaced with arch=b64 as follows:
<html:pre>-a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
    -a always,exit -F arch=b64 -S creat,open,openat,open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - creat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="creat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_creat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit creat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for creat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - creat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of creat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_creat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_creat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - ftruncate</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exiu=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="ftruncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_ftruncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit ftruncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for ftruncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - ftruncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of ftruncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_ftruncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_ftruncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - open</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_open" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_open" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - open_by_handle_at</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>
If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S open_by_handle_at,truncate,ftruncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_open_by_handle_at" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="open_by_handle_at"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_open_by_handle_at" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit open_by_handle_at tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EACCES for x86_64
    platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for open_by_handle_at EPERM for x86_64
    platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - open_by_handle_at
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of open_by_handle_at in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_open_by_handle_at
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - openat</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_openat" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="openat"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_openat" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit openat tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for openat EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - openat
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of openat in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_openat
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_openat_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Unsuccessful Access Attempts to Files - truncate</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect unauthorized file
accesses for all users and root. If the <html:code>auditd</html:code> daemon is configured
to use the <html:code>augenrules</html:code> program to read audit rules during daemon
startup (the default), add the following lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre>

If the system is 64 bit then also add the following lines:
<html:pre>
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset -F key=access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset -F key=access</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient.</xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000064-GPOS-00033</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000458-GPOS-00203</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000461-GPOS-00205</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000458-VMM-001810</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000461-VMM-001830</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing
these events could serve as evidence of potential system compromise.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

AUID_FILTERS="-F auid&gt;=1000 -F auid!=unset"
SYSCALL="truncate"
KEY="access"
SYSCALL_GROUPING="creat ftruncate truncate open openat open_by_handle_at"

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EACCES"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F exit=-EPERM"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_unsuccessful_file_modification_truncate" system="urn:xccdf:fix:script:ansible" reboot="true" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Set architecture for audit truncate tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EACCES for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EACCES -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EACCES -F auid&gt;=1000 -F
          auid!=unset (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EACCES
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy

- name: Perform remediation of Audit rules for truncate EPERM for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/access.rules
      set_fact: audit_file="/etc/audit/rules.d/access.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - truncate
        syscall_grouping:
          - creat
          - ftruncate
          - truncate
          - open
          - openat
          - open_by_handle_at

    - name: Check existence of truncate in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F exit=-EPERM -F auid&gt;=1000 -F auid!=unset
          (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F exit=-EPERM
          -F auid&gt;=1000 -F auid!=unset -F key=access
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - NIST-800-171-3.1.7
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.1
    - PCI-DSS-Req-10.2.4
    - audit_rules_unsuccessful_file_modification_truncate
    - low_complexity
    - low_disruption
    - medium_severity
    - reboot_required
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_unsuccessful_file_modification_truncate_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_kernel_module_loading">
              <xccdf-1.2:title xml:lang="en-US">Record Information on Kernel Modules Loading and Unloading</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To capture kernel module loading and unloading events, use following lines, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>
-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module,delete_module -F key=modules
</html:pre>

Place to add the lines depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the lines to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the lines to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Unloading - delete_module</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To capture kernel module unloading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S delete_module -F key=modules</html:pre>

Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="delete_module"
	KEY="modules"
	SYSCALL_GROUPING="delete_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_delete" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_delete_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code> program
to read audit rules during daemon startup (the default), add the following lines to a file
with suffix <html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code> to capture kernel module
loading and unloading events, setting ARCH to either b32 or b64 as appropriate for your system:
<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to read audit
rules during daemon startup, add the following lines to <html:code>/etc/audit/audit.rules</html:code> file
in order to capture kernel module loading and unloading events, setting ARCH to either b32 or
b64 as appropriate for your system:
<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S finit_module -F key=modules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The addition/removal of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="finit_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_finit" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20finit_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20finit_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-finit.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_finit_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects Information on Kernel Module Loading - init_module</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To capture kernel module loading events, use following line, setting ARCH to
either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit:
<html:pre>-a always,exit -F arch=<html:i>ARCH</html:i> -S init_module -F key=modules</html:pre>

Place to add the line depends on a way <html:code>auditd</html:code> daemon is configured. If it is configured
to use the <html:code>augenrules</html:code> program (the default), add the line to a file with suffix
<html:code>.rules</html:code> in the directory <html:code>/etc/audit/rules.d</html:code>.

If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility,
add the line to file <html:code>/etc/audit/audit.rules</html:code>.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000130</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000037-GPOS-00015</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000042-GPOS-00020</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000062-GPOS-00031</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000392-GPOS-00172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000462-GPOS-00206</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00215</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000471-GPOS-00216</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000477-GPOS-00222</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000477-VMM-001970</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The addition of kernel modules can be used to alter the behavior of
the kernel and potentially introduce malicious code into kernel space. It is important
to have an audit trail of modules that have been introduced into the kernel.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
# Note: 32-bit and 64-bit kernel syscall numbers not always line up =&gt;
#       it's required on a 64-bit system to check also for the presence
#       of 32-bit's equivalent of the corresponding rule.
#       (See `man 7 audit.rules` for details )
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS=""
	AUID_FILTERS=""
	SYSCALL="init_module"
	KEY="modules"
	SYSCALL_GROUPING="init_module finit_module"
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_kernel_module_loading_init" system="urn:xccdf:fix:script:kubernetes">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_kernel_module_loading_init:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_kernel_module_loading_init_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_login_events">
              <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_login_events" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter Logon and Logout Events</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The audit system already collects login information for all users
and root. If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following lines to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> in order to watch for attempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following lines to
<html:code>/etc/audit/audit.rules</html:code> file in order to watch for unattempted manual
edits of files involved in storing logon events:
<html:pre>-w /var/log/tallylog -p wa -k logins
-w /var/run/faillock -p wa -k logins
-w /var/log/lastlog -p wa -k logins</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This rule checks for multiple syscalls related to login events;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_login_events_tallylog</html:code></html:li><html:li><html:code>audit_rules_login_events_faillock</html:code></html:li><html:li><html:code>audit_rules_login_events_lastlog</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000172</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002884</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.3</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Manual editing of these files may indicate nefarious activity, such
as an attacker attempting to remove evidence of an intrusion.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_login_events" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/tallylog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/tallylog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/tallylog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/tallylog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/tallylog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/run/faillock" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/run/faillock" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/run/faillock $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/run/faillock$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/run/faillock -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/logins.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/var/log/lastlog" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/logins.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/logins.rules"
    # If the logins.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/var/log/lastlog" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/var/log/lastlog $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/var/log/lastlog$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /var/log/lastlog -p wa -k logins" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_login_events:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_privileged_commands">
              <xccdf-1.2:title xml:lang="en-US">Record Information on the Use of Privileged Commands</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">At a minimum, the audit system should collect the execution of
privileged commands for all users and root.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Ensure auditd Collects Information on the Use of Privileged Commands</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The audit system should collect information about usage of privileged
commands for all users and root. To find the relevant setuid /
setgid programs, run the following command for each local partition
<html:i>PART</html:i>:
<html:pre>$ sudo find <html:i>PART</html:i> -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>augenrules</html:code>
program to read audit rules during daemon startup (the default), add a line of
the following form to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code> for each setuid / setgid program on the system,
replacing the <html:i>SETUID_PROG_PATH</html:i> part with the full path of that setuid /
setgid program in the list:
<html:pre>-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add a line of the following
form to <html:code>/etc/audit/audit.rules</html:code> for each setuid / setgid program on the
system, replacing the <html:i>SETUID_PROG_PATH</html:i> part with the full path of that
setuid / setgid program in the list:
<html:pre>-a always,exit -F path=<html:i>SETUID_PROG_PATH</html:i> -F auid&gt;=1000 -F auid!=unset -F key=privileged</html:pre></xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">This rule checks for multiple syscalls related to privileged commands;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
<html:ul><html:li><html:code>audit_rules_privileged_commands_su</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_umount</html:code></html:li><html:li><html:code>audit_rules_privileged_commands_passwd</html:code></html:li></html:ul></xccdf-1.2:warning>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO08.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002234</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0582</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0584</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">05885</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0586</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0846</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">0957</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(4)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.DP-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.CO-2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000327-GPOS-00127</xccdf-1.2:reference>
                <xccdf-1.2:reference href="">SRG-OS-000471-VMM-001910</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
<html:br/><html:br/>
Privileged programs are subject to escalation-of-privilege attacks,
which attempt to subvert their normal role of providing some necessary but
limited capability. As such, motivation exists to monitor these programs for
unusual activity.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
files_to_inspect=()

# If the audit tool is 'auditctl', then:
# * add '/etc/audit/audit.rules'to the list of files to be inspected,
# * specify '/etc/audit/audit.rules' as the output audit file, where
#   missing rules should be inserted
files_to_inspect=("/etc/audit/audit.rules")
output_audit_file="/etc/audit/audit.rules"

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

    # Check if this sbinary wasn't already handled in some of the previous sbinary iterations
    # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
    if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
    then
        # If so, don't process it second time &amp; go to process next sbinary
        continue
    fi

    # Reset the counter of inspected files when starting to check
    # presence of existing audit rule for new sbinary
    count_of_inspected_files=0

    # Define expected rule form for this binary
    expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=1000 -F auid!=unset -F key=privileged"

    # If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
    if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
        echo "$expected_rule" &gt;&gt; "$output_audit_file"
        continue
    fi

    # Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
    sbinary_esc=${sbinary//$'/'/$'\/'}

    # For each audit rules file from the list of files to be inspected
    for afile in "${files_to_inspect[@]}"
    do
        # Search current audit rules file's content for match. Match criteria:
        # * existing rule is for the same SUID/SGID binary we are currently processing (but
        #   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
        # * existing rule contains all arguments from expected rule form (though can contain
        #   them in arbitrary order)

        base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
                -e '/-F path=[^[:space:]]\+/!d'						\
                -e '/-F auid&gt;='"1000"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
                -e '/-k \|-F key=/!d' "$afile")

        # Increase the count of inspected files for this sbinary
        count_of_inspected_files=$((count_of_inspected_files + 1))

        # Search current audit rules file's content for presence of rule pattern for this sbinary
        if [[ $base_search ]]
        then

            # Current audit rules file already contains rule for this binary =&gt;
            # Store the exact form of found rule for this binary for further processing
            concrete_rule=$base_search

            # Select all other SUID/SGID binaries possibly also present in the found rule

            readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
            handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

            # Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
            readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

            # if there is a -F perm flag, remove it
            if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

                # Separate concrete_rule into three sections using hash '#'
                # sign as a delimiter around rule's permission section borders
                # note that the trailing space after perm flag is captured because there would be 
                # two consecutive spaces after joining remaining parts of the rule together
                concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

                # Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
                rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
                rule_perm=$(cut -d '#' -f 2 &lt;&lt;&lt; "$concrete_rule")
                rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

                # Remove permissions section from existing rule in the file
                sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
            fi
        # If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
        #
        # * in the "auditctl" mode of operation insert particular rule each time
        #   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
        #
        # * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
        #   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
        #   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
        #
        elif [ "auditctl" == "auditctl" ] || [[ "auditctl" == "augenrules" &amp;&amp; $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
        then
            # Check if this sbinary wasn't already handled in some of the previous afile iterations
            # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
            if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
            then
                # Current audit rules file's content doesn't contain expected rule for this
                # SUID/SGID binary yet =&gt; append it
                echo "$expected_rule" &gt;&gt; "$output_audit_file"
            fi
            continue
        fi
    done
done
files_to_inspect=()
# If the audit tool is 'augenrules', then:
# * add '/etc/audit/rules.d/*.rules' to the list of files to be inspected
#   (split by newline),
# * specify /etc/audit/rules.d/privileged.rules' as the output file, where
#   missing rules should be inserted
readarray -t files_to_inspect &lt; &lt;(find /etc/audit/rules.d -maxdepth 1 -type f -name '*.rules' -print)
output_audit_file="/etc/audit/rules.d/privileged.rules"

# Obtain the list of SUID/SGID binaries on the particular system (split by newline)
# into privileged_binaries array
privileged_binaries=()
readarray -t privileged_binaries &lt; &lt;(find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null)

# Keep list of SUID/SGID binaries that have been already handled within some previous iteration
sbinaries_to_skip=()

# For each found sbinary in privileged_binaries list
for sbinary in "${privileged_binaries[@]}"
do

    # Check if this sbinary wasn't already handled in some of the previous sbinary iterations
    # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
    if [[ $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
    then
        # If so, don't process it second time &amp; go to process next sbinary
        continue
    fi

    # Reset the counter of inspected files when starting to check
    # presence of existing audit rule for new sbinary
    count_of_inspected_files=0

    # Define expected rule form for this binary
    expected_rule="-a always,exit -F path=${sbinary} -F auid&gt;=1000 -F auid!=unset -F key=privileged"

    # If list of audit rules files to be inspected is empty, just add new rule and move on to next binary
    if [[ ${#files_to_inspect[@]} -eq 0 ]]; then
        echo "$expected_rule" &gt;&gt; "$output_audit_file"
        continue
    fi

    # Replace possible slash '/' character in sbinary definition so we could use it in sed expressions below
    sbinary_esc=${sbinary//$'/'/$'\/'}

    # For each audit rules file from the list of files to be inspected
    for afile in "${files_to_inspect[@]}"
    do
        # Search current audit rules file's content for match. Match criteria:
        # * existing rule is for the same SUID/SGID binary we are currently processing (but
        #   can contain multiple -F path= elements covering multiple SUID/SGID binaries)
        # * existing rule contains all arguments from expected rule form (though can contain
        #   them in arbitrary order)

        base_search=$(sed -e '/-a always,exit/!d' -e '/-F path='"${sbinary_esc}"'[^[:graph:]]/!d'		\
                -e '/-F path=[^[:space:]]\+/!d'						\
                -e '/-F auid&gt;='"1000"'/!d' -e '/-F auid!=\(4294967295\|unset\)/!d'	\
                -e '/-k \|-F key=/!d' "$afile")

        # Increase the count of inspected files for this sbinary
        count_of_inspected_files=$((count_of_inspected_files + 1))

        # Search current audit rules file's content for presence of rule pattern for this sbinary
        if [[ $base_search ]]
        then

            # Current audit rules file already contains rule for this binary =&gt;
            # Store the exact form of found rule for this binary for further processing
            concrete_rule=$base_search

            # Select all other SUID/SGID binaries possibly also present in the found rule

            readarray -t handled_sbinaries &lt; &lt;(grep -o -e "-F path=[^[:space:]]\+" &lt;&lt;&lt; "$concrete_rule")
            handled_sbinaries=("${handled_sbinaries[@]//-F path=/}")

            # Merge the list of such SUID/SGID binaries found in this iteration with global list ignoring duplicates
            readarray -t sbinaries_to_skip &lt; &lt;(for i in "${sbinaries_to_skip[@]}" "${handled_sbinaries[@]}"; do echo "$i"; done | sort -du)

            # if there is a -F perm flag, remove it
            if grep -q '.*-F\s\+perm=[rwxa]\+.*' &lt;&lt;&lt; "$concrete_rule"; then

                # Separate concrete_rule into three sections using hash '#'
                # sign as a delimiter around rule's permission section borders
                # note that the trailing space after perm flag is captured because there would be 
                # two consecutive spaces after joining remaining parts of the rule together
                concrete_rule="$(echo "$concrete_rule" | sed -n "s/\(.*\)\+\(-F perm=[rwax]\+\ \?\)\+/\1#\2#/p")"

                # Split concrete_rule into head, perm, and tail sections using hash '#' delimiter
                rule_head=$(cut -d '#' -f 1 &lt;&lt;&lt; "$concrete_rule")
                rule_perm=$(cut -d '#' -f 2 &lt;&lt;&lt; "$concrete_rule")
                rule_tail=$(cut -d '#' -f 3 &lt;&lt;&lt; "$concrete_rule")

                # Remove permissions section from existing rule in the file
                sed -i "s#${rule_head}\(.*\)${rule_tail}#${rule_head}${rule_tail}#" "$afile"
            fi
        # If the required audit rule for particular sbinary wasn't found yet, insert it under following conditions:
        #
        # * in the "auditctl" mode of operation insert particular rule each time
        #   (because in this mode there's only one file -- /etc/audit/audit.rules to be inspected for presence of this rule),
        #
        # * in the "augenrules" mode of operation insert particular rule only once and only in case we have already
        #   searched all of the files from /etc/audit/rules.d/*.rules location (since that audit rule can be defined
        #   in any of those files and if not, we want it to be inserted only once into /etc/audit/rules.d/privileged.rules file)
        #
        elif [ "augenrules" == "auditctl" ] || [[ "augenrules" == "augenrules" &amp;&amp; $count_of_inspected_files -eq "${#files_to_inspect[@]}" ]]
        then
            # Check if this sbinary wasn't already handled in some of the previous afile iterations
            # Return match only if whole sbinary definition matched (not in the case just prefix matched!!!)
            if [[ ! $(sed -ne "\|${sbinary}|p" &lt;&lt;&lt; "${sbinaries_to_skip[*]}") ]]
            then
                # Current audit rules file's content doesn't contain expected rule for this
                # SUID/SGID binary yet =&gt; append it
                echo "$expected_rule" &gt;&gt; "$output_audit_file"
            fi
            continue
        fi
    done
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_privileged_commands" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search for privileged commands
  shell: |
    set -o pipefail
    find / -not \( -fstype afs -o -fstype ceph -o -fstype cifs -o -fstype smb3 -o -fstype smbfs -o -fstype sshfs -o -fstype ncpfs -o -fstype ncp -o -fstype nfs -o -fstype nfs4 -o -fstype gfs -o -fstype gfs2 -o -fstype glusterfs -o -fstype gpfs -o -fstype pvfs2 -o -fstype ocfs2 -o -fstype lustre -o -fstype davfs -o -fstype fuse.sshfs \) -type f \( -perm -4000 -o -perm -2000 \) 2&gt; /dev/null
  args:
    warn: false
    executable: /bin/bash
  check_mode: false
  register: find_result
  changed_when: false
  failed_when: false
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for audit rule entries
  find:
    paths: /etc/audit/rules.d
    recurse: false
    contains: ^.*path={{ item }} .*$
    patterns: '*.rules'
  with_items:
    - '{{ find_result.stdout_lines }}'
  register: files_result
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Overwrites the rule in rules.d
  lineinfile:
    path: '{{ item.1.path }}'
    line: -a always,exit -F path={{ item.0.item }} -F auid&gt;=1000 -F auid!=unset -F
      key=privileged
    create: false
    regexp: ^.*path={{ item.0.item }} .*$
  with_subelements:
    - '{{ files_result.results }}'
    - files
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Adds the rule in rules.d
  lineinfile:
    path: /etc/audit/rules.d/privileged.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
  with_items:
    - '{{ files_result.results }}'
  when:
    - '"audit" in ansible_facts.packages'
    - files_result.results is defined and item.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Inserts/replaces the rule in audit.rules
  lineinfile:
    path: /etc/audit/audit.rules
    line: -a always,exit -F path={{ item.item }} -F auid&gt;=1000 -F auid!=unset -F key=privileged
    create: true
    regexp: ^.*path={{ item.item }} .*$
  with_items:
    - '{{ files_result.results }}'
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-2(4)
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.2.2
    - audit_rules_privileged_commands
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_privileged_commands:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_audit_time_rules">
              <xccdf-1.2:title xml:lang="en-US">Records Events that Modify Date and Time Information</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time. All changes to the system
time should be audited.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record attempts to alter time through adjtimex</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S adjtimex -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S adjtimex -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for adjtimex for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday

    - name: Check existence of adjtimex in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - adjtimex
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of adjtimex in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_adjtimex
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_adjtimex" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_time_adjtimex:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter Time Through clock_settime</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S clock_settime -F a0=0x0 -F key=time-change</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport.
Multiple system calls can be defined on the same line to save space if
desired, but is not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# First perform the remediation of the syscall rule
# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
	ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
	OTHER_FILTERS="-F a0=0x0"
	AUID_FILTERS=""
	SYSCALL="clock_settime"
	KEY="time-change"
	SYSCALL_GROUPING=""
	# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()

# If audit tool is 'augenrules', then check if the audit rule is defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
# If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
default_file="/etc/audit/rules.d/$KEY.rules"
# As other_filters may include paths, lets use a different delimiter for it
# The "F" script expression tells sed to print the filenames where the expressions matched
readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
# Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
if [ ${#files_to_inspect[@]} -eq "0" ]
then
    file_to_inspect="/etc/audit/rules.d/$KEY.rules"
    files_to_inspect=("$file_to_inspect")
    if [ ! -e "$file_to_inspect" ]
    then
        touch "$file_to_inspect"
        chmod 0640 "$file_to_inspect"
    fi
fi

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
	# Load macro arguments into arrays
read -a syscall_a &lt;&lt;&lt; $SYSCALL
read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
# 
# -----------------------------------------------------------------------------------------
#  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
# -----------------------------------------------------------------------------------------
#        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
# -----------------------------------------------------------------------------------------
#        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
#        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
#
files_to_inspect=()


# If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# file to the list of files to be inspected
default_file="/etc/audit/audit.rules"
files_to_inspect+=('/etc/audit/audit.rules' )

# Indicator that we want to append $full_rule into $audit_file or edit a rule in it
append_expected_rule=0

# After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
skip=1

for audit_file in "${files_to_inspect[@]}"
do
    # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
    # i.e, collect rules that match:
    # * the action, list and arch, (2-nd argument)
    # * the other filters, (3-rd argument)
    # * the auid filters, (4-rd argument)
    readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

    candidate_rules=()
    # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
    for s_rule in "${similar_rules[@]}"
    do
        # Strip all the options and fields we know of,
        # than check if there was any field left over
        extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
        grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
        if [ $? -ne 0 ]
        then
            candidate_rules+=("$s_rule")
        fi
    done

    if [[ ${#syscall_a[@]} -ge 1 ]]
    then
        # Check if the syscall we want is present in any of the similar existing rules
        for rule in "${candidate_rules[@]}"
        do
            rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
            all_syscalls_found=0
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    all_syscalls_found=1
                fi
            done
            if [[ $all_syscalls_found -eq 0 ]]
            then
                # We found a rule with all the syscall(s) we want; skip rest of macro
                skip=0
                break
            fi

            # Check if this rule can be grouped with our target syscall and keep track of it
            for syscall_g in "${syscall_grouping[@]}"
            do
                if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                then
                    file_to_edit=${audit_file}
                    rule_to_edit=${rule}
                    rule_syscalls_to_edit=${rule_syscalls}
                fi
            done
        done
    else
        # If there is any candidate rule, it is compliant; skip rest of macro
        if [[ $candidate_rules ]]
        then
            skip=0
        fi
    fi

    if [ "$skip" -eq 0 ]; then
        break
    fi
done

if [ "$skip" -ne 0 ]; then
    # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
    # At this point we know if we need to either append the $full_rule or group
    # the syscall together with an exsiting rule

    # Append the full_rule if it cannot be grouped to any other rule
    if [ -z ${rule_to_edit+x} ]
    then
        # Build full_rule while avoid adding double spaces when other_filters is empty
        if [[ ${syscall_a} ]]
        then
            syscall_string=""
            for syscall in "${syscall_a[@]}"
            do
                syscall_string+=" -S $syscall"
            done
        fi
        other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
        auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
        full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
        echo "$full_rule" &gt;&gt; "$default_file"
        chmod o-rwx ${default_file}
    else
        # Check if the syscalls are declared as a comma separated list or
        # as multiple -S parameters
        if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
        then
            delimiter=","
        else
            delimiter=" -S "
        fi
        new_grouped_syscalls="${rule_syscalls_to_edit}"
        for syscall in "${syscall_a[@]}"
        do
            grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            if [ $? -eq 1 ]
            then
                # A syscall was not found in the candidate rule
                new_grouped_syscalls+="${delimiter}${syscall}"
            fi
        done

        # Group the syscall in the rule
        sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
    fi
fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for clock_settime for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/time-change.rules
      set_fact: audit_file="/etc/audit/rules.d/time-change.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - clock_settime
        syscall_grouping: []

    - name: Check existence of clock_settime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* -F a0=0x0 (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( -F a0=0x0 (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F a0=0x0 -F
          key=time-change
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_clock_settime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_clock_settime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_time_clock_settime:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record attempts to alter time through settimeofday</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code>:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-a always,exit -F arch=b32 -S settimeofday -F key=audit_time_rules</html:pre>
If the system is 64 bit then also add the following line:
<html:pre>-a always,exit -F arch=b64 -S settimeofday -F key=audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can be
used for better reporting capability through ausearch and aureport. Multiple
system calls can be defined on the same line to save space if desired, but is
not required. See an example of multiple combined syscalls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Set architecture for audit tasks
  set_fact:
    audit_arch: b{{ ansible_architecture | regex_replace('.*(\d\d$)','\1') }}
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for settimeofday for x86_64 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - settimeofday
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of settimeofday in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b64(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b64)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b64 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when:
    - '"audit" in ansible_facts.packages'
    - audit_arch == "b64"
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_settimeofday
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_settimeofday" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_time_settimeofday:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter Time Through stime</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the
default), add the following line to a file with suffix <html:code>.rules</html:code> in the
directory <html:code>/etc/audit/rules.d</html:code> for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). If the
<html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code> utility to
read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file for both 32 bit and 64 bit systems:
<html:pre>-a always,exit -F arch=b32 -S stime -F key=audit_time_rules</html:pre>
Since the 64 bit version of the "stime" system call is not defined in the audit
lookup table, the corresponding "-F arch=b64" form of this rule is not expected
to be defined on 64 bit systems (the aforementioned "-F arch=b32" stime rule
form itself is sufficient for both 32 bit and 64 bit systems). The -k option
allows for the specification of a key in string form that can be used for
better reporting capability through ausearch and aureport. Multiple system
calls can be defined on the same line to save space if desired, but is not
required. See an example of multiple combined system calls:
<html:pre>-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=audit_time_rules</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_time_stime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Retrieve hardware architecture of the underlying system
[ "$(getconf LONG_BIT)" = "32" ] &amp;&amp; RULE_ARCHS=("b32") || RULE_ARCHS=("b32" "b64")

for ARCH in "${RULE_ARCHS[@]}"
do
    # Create expected audit group and audit rule form for particular system call &amp; architecture
    if [ ${ARCH} = "b32" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call is known at 32-bit arch (see e.g "$ ausyscall i386 stime" 's output)
        # so append it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday stime"
        SYSCALL_GROUPING="adjtimex settimeofday stime"
    elif [ ${ARCH} = "b64" ]
    then
        ACTION_ARCH_FILTERS="-a always,exit -F arch=$ARCH"
        # stime system call isn't known at 64-bit arch (see "$ ausyscall x86_64 stime" 's output)
        # therefore don't add it to the list of time group system calls to be audited
        SYSCALL="adjtimex settimeofday"
        SYSCALL_GROUPING="adjtimex settimeofday"
    fi
    OTHER_FILTERS=""
    AUID_FILTERS=""
    KEY="audit_time_rules"
    # Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()

    # If audit tool is 'augenrules', then check if the audit rule is defined
    # If rule is defined, add '/etc/audit/rules.d/*.rules' to the list for inspection
    # If rule isn't defined yet, add '/etc/audit/rules.d/$key.rules' to the list for inspection
    default_file="/etc/audit/rules.d/$KEY.rules"
    # As other_filters may include paths, lets use a different delimiter for it
    # The "F" script expression tells sed to print the filenames where the expressions matched
    readarray -t files_to_inspect &lt; &lt;(sed -s -n -e "/$ACTION_ARCH_FILTERS/!d" -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" -e "F" /etc/audit/rules.d/*.rules)
    # Case when particular rule isn't defined in /etc/audit/rules.d/*.rules yet
    if [ ${#files_to_inspect[@]} -eq "0" ]
    then
        file_to_inspect="/etc/audit/rules.d/$KEY.rules"
        files_to_inspect=("$file_to_inspect")
        if [ ! -e "$file_to_inspect" ]
        then
            touch "$file_to_inspect"
            chmod 0640 "$file_to_inspect"
        fi
    fi

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
    # Load macro arguments into arrays
    read -a syscall_a &lt;&lt;&lt; $SYSCALL
    read -a syscall_grouping &lt;&lt;&lt; $SYSCALL_GROUPING

    # Create a list of audit *.rules files that should be inspected for presence and correctness
    # of a particular audit rule. The scheme is as follows:
    # 
    # -----------------------------------------------------------------------------------------
    #  Tool used to load audit rules | Rule already defined  |  Audit rules file to inspect    |
    # -----------------------------------------------------------------------------------------
    #        auditctl                |     Doesn't matter    |  /etc/audit/audit.rules         |
    # -----------------------------------------------------------------------------------------
    #        augenrules              |          Yes          |  /etc/audit/rules.d/*.rules     |
    #        augenrules              |          No           |  /etc/audit/rules.d/$key.rules  |
    # -----------------------------------------------------------------------------------------
    #
    files_to_inspect=()


    # If audit tool is 'auditctl', then add '/etc/audit/audit.rules'
    # file to the list of files to be inspected
    default_file="/etc/audit/audit.rules"
    files_to_inspect+=('/etc/audit/audit.rules' )

    # Indicator that we want to append $full_rule into $audit_file or edit a rule in it
    append_expected_rule=0

    # After converting to jinja, we cannot return; therefore we skip the rest of the macro if needed instead
    skip=1

    for audit_file in "${files_to_inspect[@]}"
    do
        # Filter existing $audit_file rules' definitions to select those that satisfy the rule pattern,
        # i.e, collect rules that match:
        # * the action, list and arch, (2-nd argument)
        # * the other filters, (3-rd argument)
        # * the auid filters, (4-rd argument)
        readarray -t similar_rules &lt; &lt;(sed -e "/$ACTION_ARCH_FILTERS/!d"  -e "\#$OTHER_FILTERS#!d" -e "/$AUID_FILTERS/!d" "$audit_file")

        candidate_rules=()
        # Filter out rules that have more fields then required. This will remove rules more specific than the required scope
        for s_rule in "${similar_rules[@]}"
        do
            # Strip all the options and fields we know of,
            # than check if there was any field left over
            extra_fields=$(sed -E -e "s/$ACTION_ARCH_FILTERS//"  -e "s#$OTHER_FILTERS##" -e "s/$AUID_FILTERS//" -e "s/((:?-S [[:alnum:],]+)+)//g" -e "s/-F key=\w+|-k \w+//"&lt;&lt;&lt; "$s_rule")
            grep -q -- "-F" &lt;&lt;&lt; "$extra_fields"
            if [ $? -ne 0 ]
            then
                candidate_rules+=("$s_rule")
            fi
        done

        if [[ ${#syscall_a[@]} -ge 1 ]]
        then
            # Check if the syscall we want is present in any of the similar existing rules
            for rule in "${candidate_rules[@]}"
            do
                rule_syscalls=$(echo "$rule" | grep -o -P '(-S [\w,]+)+' | xargs)
                all_syscalls_found=0
                for syscall in "${syscall_a[@]}"
                do
                    grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "$rule_syscalls"
                    if [ $? -eq 1 ]
                    then
                        # A syscall was not found in the candidate rule
                        all_syscalls_found=1
                    fi
                done
                if [[ $all_syscalls_found -eq 0 ]]
                then
                    # We found a rule with all the syscall(s) we want; skip rest of macro
                    skip=0
                    break
                fi

                # Check if this rule can be grouped with our target syscall and keep track of it
                for syscall_g in "${syscall_grouping[@]}"
                do
                    if grep -q -- "\b${syscall_g}\b" &lt;&lt;&lt; "$rule_syscalls"
                    then
                        file_to_edit=${audit_file}
                        rule_to_edit=${rule}
                        rule_syscalls_to_edit=${rule_syscalls}
                    fi
                done
            done
        else
            # If there is any candidate rule, it is compliant; skip rest of macro
            if [[ $candidate_rules ]]
            then
                skip=0
            fi
        fi

        if [ "$skip" -eq 0 ]; then
            break
        fi
    done

    if [ "$skip" -ne 0 ]; then
        # We checked all rules that matched the expected resemblance pattern (action, arch &amp; auid)
        # At this point we know if we need to either append the $full_rule or group
        # the syscall together with an exsiting rule

        # Append the full_rule if it cannot be grouped to any other rule
        if [ -z ${rule_to_edit+x} ]
        then
            # Build full_rule while avoid adding double spaces when other_filters is empty
            if [[ ${syscall_a} ]]
            then
                syscall_string=""
                for syscall in "${syscall_a[@]}"
                do
                    syscall_string+=" -S $syscall"
                done
            fi
            other_string=$([[ $OTHER_FILTERS ]] &amp;&amp; echo " $OTHER_FILTERS")
            auid_string=$([[ $AUID_FILTERS ]] &amp;&amp; echo " $AUID_FILTERS")
            full_rule="$ACTION_ARCH_FILTERS${syscall_string}${other_string}${auid_string} -F key=$KEY"
            echo "$full_rule" &gt;&gt; "$default_file"
            chmod o-rwx ${default_file}
        else
            # Check if the syscalls are declared as a comma separated list or
            # as multiple -S parameters
            if grep -q -- "," &lt;&lt;&lt; "${rule_syscalls_to_edit}"
            then
                delimiter=","
            else
                delimiter=" -S "
            fi
            new_grouped_syscalls="${rule_syscalls_to_edit}"
            for syscall in "${syscall_a[@]}"
            do
                grep -q -- "\b${syscall}\b" &lt;&lt;&lt; "${rule_syscalls_to_edit}"
                if [ $? -eq 1 ]
                then
                    # A syscall was not found in the candidate rule
                    new_grouped_syscalls+="${delimiter}${syscall}"
                fi
            done

            # Group the syscall in the rule
            sed -i -e "\#${rule_to_edit}#s#${rule_syscalls_to_edit}#${new_grouped_syscalls}#" "$file_to_edit"
        fi
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_stime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Perform remediation of Audit rules for stime syscall for x86 platform
  block:

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/rules.d/
      find:
        paths: /etc/audit/rules.d
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: '*.rules'
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Reset syscalls found per file
      set_fact:
        syscalls_per_file: {}
        found_paths_dict: {}

    - name: Declare syscalls found per file
      set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path
        :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
      loop: '{{ find_command.results | selectattr(''matched'') | list }}'

    - name: Declare files where syscalls were found
      set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten
        | map(attribute='path') | list }}"

    - name: Count occurrences of syscalls in paths
      set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item,
        0) }) }}"
      loop: '{{ find_command.results | map(attribute=''files'') | flatten | map(attribute=''path'')
        | list }}'

    - name: Get path with most syscalls
      set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value')
        | last).key }}"
      when: found_paths | length &gt;= 1

    - name: No file with syscall found, set path to /etc/audit/rules.d/audit_time_rules.rules
      set_fact: audit_file="/etc/audit/rules.d/audit_time_rules.rules"
      when: found_paths | length == 0

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file]
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0

    - name: Declare list of syscalls
      set_fact:
        syscalls:
          - stime
        syscall_grouping:
          - adjtimex
          - settimeofday
          - stime

    - name: Check existence of stime in /etc/audit/audit.rules
      find:
        paths: /etc/audit
        contains: -a always,exit -F arch=b32(( -S |,)\w+)*(( -S |,){{ item }})+((
          -S |,)\w+)* (-k\s+|-F\s+key=)\S+\s*$
        patterns: audit.rules
      register: find_command
      loop: '{{ (syscall_grouping + syscalls) | unique }}'

    - name: Set path to /etc/audit/audit.rules
      set_fact: audit_file="/etc/audit/audit.rules"

    - name: Declare found syscalls
      set_fact: syscalls_found="{{ find_command.results | selectattr('matched') |
        map(attribute='item') | list }}"

    - name: Declare missing syscalls
      set_fact: missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

    - name: Replace the audit rule in {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        regexp: (-a always,exit -F arch=b32)(?=.*(?:(?:-S |,)(?:{{ syscalls_found
          | join("|") }}))\b)((?:( -S |,)\w+)+)( (?:-k |-F key=)\w+)
        line: \1\2\3{{ missing_syscalls | join("\3") }}\4
        backrefs: true
        state: present
      when: syscalls_found | length &gt; 0 and missing_syscalls | length &gt; 0

    - name: Add the audit rule to {{ audit_file }}
      lineinfile:
        path: '{{ audit_file }}'
        line: -a always,exit -F arch=b32 -S {{ syscalls | join(',') }} -F key=audit_time_rules
        create: true
        mode: o-rwx
        state: present
      when: syscalls_found | length == 0
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_stime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_stime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20stime%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20stime%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-syscall-stime.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_time_stime:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Record Attempts to Alter the localtime File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">If the <html:code>auditd</html:code> daemon is configured to use the
<html:code>augenrules</html:code> program to read audit rules during daemon startup (the default),
add the following line to a file with suffix <html:code>.rules</html:code> in the directory
<html:code>/etc/audit/rules.d</html:code>:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
If the <html:code>auditd</html:code> daemon is configured to use the <html:code>auditctl</html:code>
utility to read audit rules during daemon startup, add the following line to
<html:code>/etc/audit/audit.rules</html:code> file:
<html:pre>-w /etc/localtime -p wa -k audit_time_rules</html:pre>
The -k option allows for the specification of a key in string form that can
be used for better reporting capability through ausearch and aureport and
should always be used.</xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO10.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.03</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA01.05</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001487</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000169</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(3)(ii)(A)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(i)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.2.6.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-2(d)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-12(c)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(9)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-7</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">ID.SC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.2.b</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">Arbitrary changes to the system time can be used to obfuscate
nefarious activities in log files, as well as to confuse network services that
are highly dependent upon an accurate system time (such as sshd). All changes
to the system time should be audited.</xccdf-1.2:rationale>
                <xccdf-1.2:platform idref="cpe:/a:audit"/>
                <xccdf-1.2:fix id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

# Perform the remediation for both possible tools: 'auditctl' and 'augenrules'
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()


# If the audit tool is 'auditctl', then add '/etc/audit/audit.rules'
# into the list of files to be inspected
files_to_inspect+=('/etc/audit/audit.rules')

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done
# Create a list of audit *.rules files that should be inspected for presence and correctness
# of a particular audit rule. The scheme is as follows:
#
# -----------------------------------------------------------------------------------------
# Tool used to load audit rules	| Rule already defined	|  Audit rules file to inspect	  |
# -----------------------------------------------------------------------------------------
#	auditctl		|     Doesn't matter	|  /etc/audit/audit.rules	  |
# -----------------------------------------------------------------------------------------
# 	augenrules		|          Yes		|  /etc/audit/rules.d/*.rules	  |
# 	augenrules		|          No		|  /etc/audit/rules.d/$key.rules  |
# -----------------------------------------------------------------------------------------
files_to_inspect=()

# If the audit is 'augenrules', then check if rule is already defined
# If rule is defined, add '/etc/audit/rules.d/*.rules' to list of files for inspection.
# If rule isn't defined, add '/etc/audit/rules.d/audit_time_rules.rules' to list of files for inspection.
readarray -t matches &lt; &lt;(grep -HP "[\s]*-w[\s]+/etc/localtime" /etc/audit/rules.d/*.rules)

# For each of the matched entries
for match in "${matches[@]}"
do
    # Extract filepath from the match
    rulesd_audit_file=$(echo $match | cut -f1 -d ':')
    # Append that path into list of files for inspection
    files_to_inspect+=("$rulesd_audit_file")
done
# Case when particular audit rule isn't defined yet
if [ "${#files_to_inspect[@]}" -eq "0" ]
then
    # Append '/etc/audit/rules.d/audit_time_rules.rules' into list of files for inspection
    key_rule_file="/etc/audit/rules.d/audit_time_rules.rules"
    # If the audit_time_rules.rules file doesn't exist yet, create it with correct permissions
    if [ ! -e "$key_rule_file" ]
    then
        touch "$key_rule_file"
        chmod 0640 "$key_rule_file"
    fi
    files_to_inspect+=("$key_rule_file")
fi

# Finally perform the inspection and possible subsequent audit rule
# correction for each of the files previously identified for inspection
for audit_rules_file in "${files_to_inspect[@]}"
do
    # Check if audit watch file system object rule for given path already present
    if grep -q -P -- "[\s]*-w[\s]+/etc/localtime" "$audit_rules_file"
    then
        # Rule is found =&gt; verify yet if existing rule definition contains
        # all of the required access type bits

        # Define BRE whitespace class shortcut
        sp="[[:space:]]"
        # Extract current permission access types (e.g. -p [r|w|x|a] values) from audit rule
        current_access_bits=$(sed -ne "s#$sp*-w$sp\+/etc/localtime $sp\+-p$sp\+\([rxwa]\{1,4\}\).*#\1#p" "$audit_rules_file")
        # Split required access bits string into characters array
        # (to check bit's presence for one bit at a time)
        for access_bit in $(echo "wa" | grep -o .)
        do
            # For each from the required access bits (e.g. 'w', 'a') check
            # if they are already present in current access bits for rule.
            # If not, append that bit at the end
            if ! grep -q "$access_bit" &lt;&lt;&lt; "$current_access_bits"
            then
                # Concatenate the existing mask with the missing bit
                current_access_bits="$current_access_bits$access_bit"
            fi
        done
        # Propagate the updated rule's access bits (original + the required
        # ones) back into the /etc/audit/audit.rules file for that rule
        sed -i "s#\($sp*-w$sp\+/etc/localtime$sp\+-p$sp\+\)\([rxwa]\{1,4\}\)\(.*\)#\1$current_access_bits\3#" "$audit_rules_file"
    else
        # Rule isn't present yet. Append it at the end of $audit_rules_file file
        # with proper key

        echo "-w /etc/localtime -p wa -k audit_time_rules" &gt;&gt; "$audit_rules_file"
    fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: '*.rules'
  register: find_existing_watch_rules_d
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Search /etc/audit/rules.d for other rules with specified key audit_time_rules
  find:
    paths: /etc/audit/rules.d
    contains: ^.*(?:-F key=|-k\s+)audit_time_rules$
    patterns: '*.rules'
  register: find_watch_key
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use /etc/audit/rules.d/audit_time_rules.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/audit_time_rules.rules
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - '{{ find_watch_key.files | map(attribute=''path'') | list | first }}'
  when:
    - '"audit" in ansible_facts.packages'
    - find_watch_key.matched is defined and find_watch_key.matched &gt; 0 and find_existing_watch_rules_d.matched
      is defined and find_existing_watch_rules_d.matched == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/rules.d/
  lineinfile:
    path: '{{ all_files[0] }}'
    line: -w /etc/localtime -p wa -k audit_time_rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Check if watch rule for /etc/localtime already exists in /etc/audit/audit.rules
  find:
    paths: /etc/audit/
    contains: ^\s*-w\s+/etc/localtime\s+-p\s+wa(\s|$)+
    patterns: audit.rules
  register: find_existing_watch_audit_rules
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy

- name: Add watch rule for /etc/localtime in /etc/audit/audit.rules
  lineinfile:
    line: -w /etc/localtime -p wa -k audit_time_rules
    state: present
    dest: /etc/audit/audit.rules
    create: true
    mode: '0640'
  when:
    - '"audit" in ansible_facts.packages'
    - find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched
      == 0
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.1.7
    - NIST-800-53-AC-6(9)
    - NIST-800-53-AU-12(c)
    - NIST-800-53-AU-2(d)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.2.b
    - audit_rules_time_watch_localtime
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="audit_rules_time_watch_localtime" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,-w%20/etc/localtime%20-p%20wa%20-k%20audit_time_rules%0A
        mode: 0600
        path: /etc/audit/rules.d/75-etclocaltime-wa-audit_time_rules.rules
        overwrite: true
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-audit_rules_time_watch_localtime:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_auditd_data_retention">
            <xccdf-1.2:title xml:lang="en-US">Configure auditd Data Retention</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The audit system writes data to <html:code>/var/log/audit/audit.log</html:code>. By default,
<html:code>auditd</html:code> rotates 5 logs by size (6MB), retaining a maximum of 30MB of
data in total, and refuses to write entries when the disk is too
full. This minimizes the risk of audit data filling its partition
and impacting other services. This also minimizes the risk of the audit
daemon temporarily disabling the system if it cannot write audit log (which
it can be configured to do).

For a busy
system or a system which is thoroughly auditing system activity, the default settings
for data retention may be
 insufficient. The log file size needed will depend heavily on what types
of events are being audited. First configure auditing to log all the events of
interest. Then monitor the log size manually for awhile to determine what file
size will allow you to keep the required data for the correct time period.
<html:br/><html:br/>
Using a dedicated partition for <html:code>/var/log/audit</html:code> prevents the
<html:code>auditd</html:code> logs from disrupting system functionality if they fill, and,
more importantly, prevents other activity in <html:code>/var</html:code> from filling the
partition and stopping the audit trail. (The audit logs are size-limited and
therefore unlikely to grow without bound unless configured to do so.) Some
machines may have requirements that no actions occur which cannot be audited.
If this is the case, then <html:code>auditd</html:code> can be configured to halt the machine
if it runs out of space. <html:b>Note:</html:b> Since older logs are rotated,
configuring <html:code>auditd</html:code> this way does not prevent older logs from being
rotated away before they can be viewed.

<html:i>If your system is configured to halt when logging cannot be performed, make
sure this can never happen under normal circumstances! Ensure that
<html:code>/var/log/audit</html:code> is on its own partition, and that this partition is
larger than the maximum amount of data <html:code>auditd</html:code> will retain
normally.</html:i></xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:audit"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for audispd to take when disk is full</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for disk_full_action in /etc/audisp/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn_once">warn_once</xccdf-1.2:value>
              <xccdf-1.2:value selector="stop">stop</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for audispd to take when network fails</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for network_failure_action in /etc/audisp/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn_once">warn_once</xccdf-1.2:value>
              <xccdf-1.2:value selector="stop">stop</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_audispd_remote_server" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Remote server for audispd to send audit records</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">
The setting for remote_server in /etc/audit/audisp-remote.conf</xccdf-1.2:description>
              <xccdf-1.2:value>logcollector</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" type="string">
              <xccdf-1.2:title xml:lang="en-US">Account for auditd to send email when actions occurs</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for action_mail_acct in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="admin">admin</xccdf-1.2:value>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for auditd to take when disk space is low</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for admin_space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for auditd to take when disk errors</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for disk_error_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for auditd to take when disk is full</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for disk_full_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>single</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_flush" type="string">
              <xccdf-1.2:title xml:lang="en-US">Auditd priority for flushing data to disk</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for flush in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="data">data</xccdf-1.2:value>
              <xccdf-1.2:value>data</xccdf-1.2:value>
              <xccdf-1.2:value selector="incremental">incremental</xccdf-1.2:value>
              <xccdf-1.2:value selector="incremental_async">incremental_async</xccdf-1.2:value>
              <xccdf-1.2:value selector="none">none</xccdf-1.2:value>
              <xccdf-1.2:value selector="sync">sync</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" type="number">
              <xccdf-1.2:title xml:lang="en-US">Maximum audit log file size for auditd</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for max_log_file in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="6">6</xccdf-1.2:value>
              <xccdf-1.2:value>6</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for auditd to take when log files reach their maximum size</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for max_log_file_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="keep_logs">keep_logs</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_num_logs" type="number">
              <xccdf-1.2:title xml:lang="en-US">Number of log files for auditd to retain</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for num_logs in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
              <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
              <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
              <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
              <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
              <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
              <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
              <xccdf-1.2:value selector="20">20</xccdf-1.2:value>
              <xccdf-1.2:value selector="50">50</xccdf-1.2:value>
              <xccdf-1.2:value selector="100">100</xccdf-1.2:value>
              <xccdf-1.2:value>5</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left" type="number">
              <xccdf-1.2:title xml:lang="en-US">Size remaining in disk space before prompting space_left_action</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for space_left (MB) in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="1000MB">1000</xccdf-1.2:value>
              <xccdf-1.2:value selector="100MB">100</xccdf-1.2:value>
              <xccdf-1.2:value selector="250MB">250</xccdf-1.2:value>
              <xccdf-1.2:value selector="500MB">500</xccdf-1.2:value>
              <xccdf-1.2:value selector="750MB">750</xccdf-1.2:value>
              <xccdf-1.2:value>100</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" type="string">
              <xccdf-1.2:title xml:lang="en-US">Action for auditd to take when disk space just starts to run low</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for space_left_action in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value>email</xccdf-1.2:value>
              <xccdf-1.2:value selector="email">email</xccdf-1.2:value>
              <xccdf-1.2:value selector="exec">exec</xccdf-1.2:value>
              <xccdf-1.2:value selector="halt">halt</xccdf-1.2:value>
              <xccdf-1.2:value selector="single">single</xccdf-1.2:value>
              <xccdf-1.2:value selector="suspend">suspend</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
              <xccdf-1.2:value selector="rotate">rotate</xccdf-1.2:value>
              <xccdf-1.2:value selector="ignore">ignore</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage" type="number" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">The percentage remaining in disk space before prompting space_left_action</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for space_left as a percentage in /etc/audit/auditd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="25pc">25</xccdf-1.2:value>
              <xccdf-1.2:value selector="50pc">50</xccdf-1.2:value>
              <xccdf-1.2:value selector="75pc">75</xccdf-1.2:value>
              <xccdf-1.2:value>25</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd to use audispd's syslog plugin</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To configure the <html:code>auditd</html:code> service to use the
<html:code>syslog</html:code> plug-in of the <html:code>audispd</html:code> audit event multiplexor, set
the <html:code>active</html:code> line in <html:code>/etc/audit/plugins.d/syslog.conf</html:code> to <html:code>yes</html:code>.
Restart the <html:code>auditd</html:code> service:
<html:pre>$ sudo service auditd restart</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000136</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(D)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(5)(ii)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(6)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(8)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(i)(C)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.314(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-4(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.niap-ccevs.org/Profile/PP.cfm">FAU_GEN.1.1.c</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000479-GPOS-00224</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000342-GPOS-00133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000051-VMM-000230</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000058-VMM-000270</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000059-VMM-000280</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000479-VMM-001990</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The auditd service does not include the ability to send audit
records to a centralized server for management directly. It does, however,
include a plug-in for audit event multiplexor (audispd) to pass audit records
to the local syslog server</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_audispd_syslog_plugin_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then

var_syslog_active="yes"


AUDISP_SYSLOGCONFIG=/etc/audit/plugins.d/syslog.conf


# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDISP_SYSLOGCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^active")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_syslog_active"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^active\\&gt;" "$AUDISP_SYSLOGCONFIG"; then
    "${sed_command[@]}" "s/^active\\&gt;.*/$formatted_output/gi" "$AUDISP_SYSLOGCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDISP_SYSLOGCONFIG" &gt;&gt; "$AUDISP_SYSLOGCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDISP_SYSLOGCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_audispd_syslog_plugin_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.3
    - auditd_audispd_syslog_plugin_activated
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: enable syslog plugin
  lineinfile:
    dest: /etc/audit/plugins.d/syslog.conf
    regexp: ^active
    line: active = yes
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-4(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.5.3
    - auditd_audispd_syslog_plugin_activated
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd mail_acct Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>auditd</html:code> service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in <html:code>/etc/audit/auditd.conf</html:code> to ensure that administrators are notified
via email for those situations:
<html:pre>action_mail_acct = <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000139</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">IA-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7.a</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000046-GPOS-00022</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000046-VMM-000210</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000343-VMM-001240</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_action_mail_acct="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^action_mail_acct")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_action_mail_acct"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^action_mail_acct\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^action_mail_acct\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_action_mail_acct" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_action_mail_acct # promote to variable
  set_fact:
    var_auditd_action_mail_acct: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct" use="legacy"/>
  tags:
    - always

- name: Configure auditd mail_acct Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: action_mail_acct = {{ var_auditd_action_mail_acct }}
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-IA-5(1)
    - PCI-DSS-Req-10.7.a
    - auditd_data_retention_action_mail_acct
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_action_mail_acct:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_action_mail_acct:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd admin_space_left Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>auditd</html:code> service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>admin_space_left_action = <html:i>ACTION</html:i></html:pre>
Set this value to <html:code>single</html:code> to cause the system to switch to single user
mode for corrective action. Acceptable values also include <html:code>suspend</html:code> and
<html:code>halt</html:code>. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for <html:i>ACTION</html:i> are described in the
<html:code>auditd.conf</html:code> man page.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001343</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Administrators should be made aware of an inability to record
audit records. If a separate partition or logical volume of adequate size
is used, running low on space for audit records should never occur.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_admin_space_left_action="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^admin_space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_admin_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^admin_space_left_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^admin_space_left_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_admin_space_left_action # promote to variable
  set_fact:
    var_auditd_admin_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd admin_space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: admin_space_left_action = {{ var_auditd_admin_space_left_action }}
    regexp: ^\s*admin_space_left_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_admin_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_admin_space_left_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_admin_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd Max Log File Size</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Determine the amount of audit data (in megabytes)
which should be retained in each log file. Edit the file
<html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following line, substituting
the correct value of <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/> for <html:i>STOREMB</html:i>:
<html:pre>max_log_file = <html:i>STOREMB</html:i></html:pre>
Set the value to <html:code>6</html:code> (MB) or higher for general-purpose systems.
Larger values, of course,
support retention of even more audit data.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum
log file size and the number of logs retained.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_max_log_file="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file # promote to variable
  set_fact:
    var_auditd_max_log_file: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file" use="legacy"/>
  tags:
    - always

- name: Configure auditd Max Log File Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    regexp: ^\s*max_log_file\s*=\s*.*$
    line: max_log_file = {{ var_auditd_max_log_file }}
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_max_log_file:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_max_log_file:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd max_log_file_action Upon Reaching Maximum Log Size</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default action to take when the logs reach their maximum size
is to rotate the log files, discarding the oldest one. To configure the action taken
by <html:code>auditd</html:code>, add or correct the line in <html:code>/etc/audit/auditd.conf</html:code>:
<html:pre>max_log_file_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man
page. These include:
<html:ul><html:li><html:code>syslog</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>rotate</html:code></html:li><html:li><html:code>keep_logs</html:code></html:li></html:ul>
Set the <html:code><html:i>ACTION</html:i></html:code> to <html:code>rotate</html:code> to ensure log rotation
occurs. This is the default. The setting is case-insensitive.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000140</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000047-GPOS-00023</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Automatically rotating logs (by setting this to <html:code>rotate</html:code>)
minimizes the chances of the system unexpectedly running out of disk space by
being overwhelmed with log data. However, for systems that must never discard
log data, or which use external processes to transfer it and reclaim space,
<html:code>keep_logs</html:code> can be employed.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_max_log_file_action="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^max_log_file_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_max_log_file_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^max_log_file_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^max_log_file_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_max_log_file_action # promote to variable
  set_fact:
    var_auditd_max_log_file_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: max_log_file_action = {{ var_auditd_max_log_file_action }}
    regexp: ^\s*max_log_file_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_max_log_file_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_max_log_file_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_max_log_file_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_max_log_file_action:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd Number of Logs Retained</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Determine how many log files
<html:code>auditd</html:code> should retain when it rotates logs.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Add or modify the following
line, substituting <html:i>NUMLOGS</html:i> with the correct value of <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>:
<html:pre>num_logs = <html:i>NUMLOGS</html:i></html:pre>
Set the value to 5 for general-purpose systems.
Note that values less than 2 result in no log rotation.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The total storage for audit log files must be large enough to retain
log information over the period required. This is a function of the maximum log
file size and the number of logs retained.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_num_logs="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>"



AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^num_logs")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_num_logs"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^num_logs\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^num_logs\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_num_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_num_logs # promote to variable
  set_fact:
    var_auditd_num_logs: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs" use="legacy"/>
  tags:
    - always

- name: Configure auditd Number of Logs Retained
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: num_logs = {{ var_auditd_num_logs }}
    regexp: ^\s*num_logs\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-11
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_num_logs
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_num_logs" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_num_logs:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_num_logs"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_num_logs:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Configure auditd space_left Action on Low Disk Space</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>auditd</html:code> service can be configured to take an action
when disk space <html:i>starts</html:i> to run low.
Edit the file <html:code>/etc/audit/auditd.conf</html:code>. Modify the following line,
substituting <html:i>ACTION</html:i> appropriately:
<html:pre>space_left_action = <html:i>ACTION</html:i></html:pre>
Possible values for <html:i>ACTION</html:i> are described in the <html:code>auditd.conf</html:code> man page.
These include:
<html:ul><html:li><html:code>syslog</html:code></html:li><html:li><html:code>email</html:code></html:li><html:li><html:code>exec</html:code></html:li><html:li><html:code>suspend</html:code></html:li><html:li><html:code>single</html:code></html:li><html:li><html:code>halt</html:code></html:li></html:ul>
Set this to <html:code>email</html:code> (instead of the default,
which is <html:code>suspend</html:code>) as it is more likely to get prompt attention. Acceptable values
also include <html:code>suspend</html:code>, <html:code>single</html:code>, and <html:code>halt</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">19</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.4.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO12.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI04.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI08.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS02.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001855</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.2.3.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.16.1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.17.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(2)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-5(4)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.AE-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">RS.AN-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000343-GPOS-00134</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000343-VMM-001240</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Notifying administrators of an impending disk space problem may
allow them to take corrective action prior to any disruption.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:audit"/>
              <xccdf-1.2:fix id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if rpm --quiet -q audit; then


var_auditd_space_left_action="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>"



#
# If space_left_action present in /etc/audit/auditd.conf, change value
# to var_auditd_space_left_action, else
# add "space_left_action = $var_auditd_space_left_action" to /etc/audit/auditd.conf
#

AUDITCONFIG=/etc/audit/auditd.conf

# Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
# Otherwise, regular sed command will do.
sed_command=('sed' '-i')
if test -L "$AUDITCONFIG"; then
    sed_command+=('--follow-symlinks')
fi

# If the cce arg is empty, CCE is not assigned.
if [ -z "" ]; then
    cce="CCE"
else
    cce=""
fi

# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' &lt;&lt;&lt; "^space_left_action")

# shellcheck disable=SC2059
printf -v formatted_output "%s = %s" "$stripped_key" "$var_auditd_space_left_action"

# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \&gt;),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^space_left_action\\&gt;" "$AUDITCONFIG"; then
    "${sed_command[@]}" "s/^space_left_action\\&gt;.*/$formatted_output/gi" "$AUDITCONFIG"
else
    # \n is precaution for case where file ends without trailing newline
    printf '\n# Per %s: Set %s in %s\n' "$cce" "$formatted_output" "$AUDITCONFIG" &gt;&gt; "$AUDITCONFIG"
    printf '%s\n' "$formatted_output" &gt;&gt; "$AUDITCONFIG"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
- name: XCCDF Value var_auditd_space_left_action # promote to variable
  set_fact:
    var_auditd_space_left_action: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action" use="legacy"/>
  tags:
    - always

- name: Configure auditd space_left Action on Low Disk Space
  lineinfile:
    dest: /etc/audit/auditd.conf
    line: space_left_action = {{ var_auditd_space_left_action }}
    regexp: ^\s*space_left_action\s*=\s*.*$
    state: present
    create: true
  when: '"audit" in ansible_facts.packages'
  tags:
    - CJIS-5.4.1.1
    - NIST-800-171-3.3.1
    - NIST-800-53-AU-5(1)
    - NIST-800-53-AU-5(2)
    - NIST-800-53-AU-5(4)
    - NIST-800-53-AU-5(b)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - auditd_data_retention_space_left_action
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="auditd_data_retention_space_left_action" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%0A%23%20This%20file%20controls%20the%20configuration%20of%20the%20audit%20daemon%0A%23%0A%0Alocal_events%20%3D%20yes%0Awrite_logs%20%3D%20yes%0Alog_file%20%3D%20/var/log/audit/audit.log%0Alog_group%20%3D%20root%0Alog_format%20%3D%20ENRICHED%0Aflush%20%3D%20incremental_async%0Afreq%20%3D%2050%0Amax_log_file%20%3D%208%0Anum_logs%20%3D%205%0Apriority_boost%20%3D%204%0Aname_format%20%3D%20hostname%0A%23%23name%20%3D%20mydomain%0Amax_log_file_action%20%3D%20rotate%0Aspace_left%20%3D%20100%0Aspace_left_action%20%3D%20syslog%0Averify_email%20%3D%20yes%0Aaction_mail_acct%20%3D%20root%0Aadmin_space_left%20%3D%2050%0Aadmin_space_left_action%20%3D%20syslog%0Adisk_full_action%20%3D%20syslog%0Adisk_error_action%20%3D%20syslog%0Ause_libwrap%20%3D%20yes%0A%23%23tcp_listen_port%20%3D%2060%0Atcp_listen_queue%20%3D%205%0Atcp_max_per_addr%20%3D%201%0A%23%23tcp_client_ports%20%3D%201024-65535%0Atcp_client_max_idle%20%3D%200%0Atransport%20%3D%20TCP%0Akrb5_principal%20%3D%20auditd%0A%23%23krb5_key_file%20%3D%20/etc/audit/audit.key%0Adistribute_network%20%3D%20no%0Aq_depth%20%3D%20400%0Aoverflow_action%20%3D%20syslog%0Amax_restarts%20%3D%2010%0Aplugin_dir%20%3D%20/etc/audit/plugins.d
        mode: 0640
        path: /etc/audit/auditd.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_auditd_space_left_action:var:1" value-id="xccdf_org.ssgproject.content_value_var_auditd_space_left_action"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-auditd_data_retention_space_left_action:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_policy_rules">
            <xccdf-1.2:title xml:lang="en-US">System Accounting with auditd</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>auditd</html:code> program can perform comprehensive
monitoring of system activity. This section makes use of recommended
configuration settings for specific policies or use cases.
The rules in this section make use of rules defined in <html:code>/usr/share/doc/audit-VERSION/rules</html:code>.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apparmor">
          <xccdf-1.2:title xml:lang="en-US">AppArmor</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Many security vulnerabilities result from bugs in trusted programs. A trusted
program runs with privileges that attackers want to possess. The program fails
to keep that trust if there is a bug in the program that allows the attacker to
acquire said privilege.
<html:br/><html:br/>
AppArmor® is an application security solution designed specifically to apply
privilege confinement to suspect programs. AppArmor allows the administrator to
specify the domain of activities the program can perform by developing a
security profile. A security profile is a listing of files that the program may
access and the operations the program may perform. AppArmor secures
applications by enforcing good application behavior without relying on attack
signatures, so it can prevent attacks even if previously unknown
vulnerabilities are being exploited.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_bootloader-grub2">
          <xccdf-1.2:title xml:lang="en-US">GRUB2 bootloader configuration</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">During the boot process, the boot loader is
responsible for starting the execution of the kernel and passing
options to it. The boot loader allows for the selection of
different kernels - possibly on different partitions or media.
The default Fedora boot loader for x86 systems is called GRUB2.
Options it can pass to the kernel include <html:i>single-user mode</html:i>, which
provides root access without any authentication, and the ability to
disable SELinux. To prevent local users from modifying the boot
parameters and endangering security, protect the boot loader configuration
with a password and ensure its configuration file's permissions
are set properly.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:grub2"/>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_non-uefi">
            <xccdf-1.2:title xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Non-UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:non-uefi"/>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Verify /boot/grub2/grub.cfg Group Ownership</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The file <html:code>/boot/grub2/grub.cfg</html:code> should
be group-owned by the <html:code>root</html:code> group to prevent
destruction or modification of the file.

To properly set the group owner of <html:code>{{{ grub2_boot_path }}}/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chgrp root {{{ grub2_boot_path }}}/grub.cfg</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The <html:code>root</html:code> group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:fix id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chgrp 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="file_groupowner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    group: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_groupowner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-file_groupowner_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-file_groupowner_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Verify /boot/grub2/grub.cfg User Ownership</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The file <html:code>/boot/grub2/grub.cfg</html:code> should
be owned by the <html:code>root</html:code> user to prevent destruction
or modification of the file.

To properly set the owner of <html:code>{{{ grub2_boot_path }}}/grub.cfg</html:code>, run the command:
<html:pre>$ sudo chown root {{{ grub2_boot_path }}}/grub.cfg </html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000225</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(1)(ii)(B)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(7)(ii)(A)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(a)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(c)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(d)(2)(iii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-7.1</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Only root should be able to modify important boot parameters.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:fix id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

chown 0 /boot/grub2/grub.cfg

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="file_owner_grub2_cfg" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /boot/grub2/grub.cfg
  stat:
    path: /boot/grub2/grub.cfg
  register: file_exists
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /boot/grub2/grub.cfg
  file:
    path: /boot/grub2/grub.cfg
    owner: '0'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-171-3.4.5
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-7.1
    - configure_strategy
    - file_owner_grub2_cfg
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-file_owner_grub2_cfg:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-file_owner_grub2_cfg_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_uefi">
            <xccdf-1.2:title xml:lang="en-US">UEFI GRUB2 bootloader configuration</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">UEFI GRUB2 bootloader configuration</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:uefi"/>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_bootloader-zipl">
          <xccdf-1.2:title xml:lang="en-US">zIPL bootloader configuration</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">During the boot process, the bootloader is
responsible for starting the execution of the kernel and passing
options to it.
The default Fedora boot loader for s390x systems is called zIPL.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:s390x_arch"/>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_entropy">
          <xccdf-1.2:title xml:lang="en-US">Protect Random-Number Entropy Pool</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The I/O operations of the Linux kernel block layer due to their inherently
unpredictable execution times have been traditionally considered as a reliable
source to contribute to random-number entropy pool of the Linux kernel. This
has changed with introduction of solid-state storage devices (SSDs) though.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_logging">
          <xccdf-1.2:title xml:lang="en-US">Configure Syslog</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The syslog service has been the default Unix logging mechanism for
many years. It has a number of downsides, including inconsistent log format,
lack of authentication for received messages, and lack of authentication,
encryption, or reliable transport for messages sent over a network. However,
due to its long history, syslog is a de facto standard which is supported by
almost all Unix applications.
<html:br/>
<html:br/>
In Fedora, rsyslog has replaced ksyslogd as the
syslog daemon of choice, and it includes some additional security features
such as reliable, connection-oriented (i.e. TCP) transmission of logs, the
option to log to database formats, and the encryption of log data en route to
a central logging server.
This section discusses how to configure rsyslog for
best effect, and how to use tools provided with the system to maintain and
monitor logs.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_logwatch_on_logserver">
            <xccdf-1.2:title xml:lang="en-US">Configure Logwatch on the Central Log Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Is this system the central log server? If so, edit the file <html:code>/etc/logwatch/conf/logwatch.conf</html:code> as shown below.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ensure_rsyslog_log_file_configuration">
            <xccdf-1.2:title xml:lang="en-US">Ensure Proper Configuration of Log Files</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The file <html:code>/etc/rsyslog.conf</html:code> controls where log message are written.
These are controlled by lines called <html:i>rules</html:i>, which consist of a
<html:i>selector</html:i> and an <html:i>action</html:i>.
These rules are often customized depending on the role of the system, the
requirements of the environment, and whatever may enable
the administrator to most effectively make use of log data.
The default rules in Fedora are:
<html:pre>*.info;mail.none;authpriv.none;cron.none                /var/log/messages
authpriv.*                                              /var/log/secure
mail.*                                                  -/var/log/maillog
cron.*                                                  /var/log/cron
*.emerg                                                 *
uucp,news.crit                                          /var/log/spooler
local7.*                                                /var/log/boot.log</html:pre>
See the man page <html:code>rsyslog.conf(5)</html:code> for more information.
<html:i>Note that the <html:code>rsyslog</html:code> daemon can be configured to use a timestamp format that
some log processing programs may not understand. If this occurs,
edit the file <html:code>/etc/rsyslog.conf</html:code> and add or edit the following line:</html:i>
<html:pre>$ ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat</html:pre></xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" type="string">
              <xccdf-1.2:title xml:lang="en-US">group who owns log files</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify group owner of all logfiles specified in
<html:code>/etc/rsyslog.conf.</html:code></xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="adm">adm</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" type="string">
              <xccdf-1.2:title xml:lang="en-US">User who owns log files</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify user owner of all logfiles specified in
<html:code>/etc/rsyslog.conf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:value>root</xccdf-1.2:value>
              <xccdf-1.2:value selector="adm">adm</xccdf-1.2:value>
              <xccdf-1.2:value selector="root">root</xccdf-1.2:value>
              <xccdf-1.2:value selector="syslog">syslog</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure Log Files Are Owned By Appropriate Group</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The group-owner of all log files written by
<html:code>rsyslog</html:code> should be <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's group owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre>$ sudo chgrp <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-rsyslog_files_groupownership:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure Log Files Are Owned By Appropriate User</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The owner of all log files written by
<html:code>rsyslog</html:code> should be <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>.
These log files are determined by the second part of each Rule line in
<html:code>/etc/rsyslog.conf</html:code> and typically all appear in <html:code>/var/log</html:code>.
For each log file <html:i>LOGFILE</html:i> referenced in <html:code>/etc/rsyslog.conf</html:code>,
run the following command to inspect the file's owner:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the owner is not <html:code><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/></html:code>, run the following command to
correct this:
<html:pre>$ sudo chown <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value" use="legacy"/> <html:i>LOGFILE</html:i></html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R46)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">The log files generated by rsyslog contain valuable information regarding system
configuration, user authentication, and other such information. Log files should be
protected from unauthorized access.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-rsyslog_files_ownership:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure System Log Files Have Correct Permissions</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The file permissions for all log files written by <html:code>rsyslog</html:code> should
be set to 600, or more restrictive. These log files are determined by the
second part of each Rule line in <html:code>/etc/rsyslog.conf</html:code> and typically
all appear in <html:code>/var/log</html:code>. For each log file <html:i>LOGFILE</html:i>
referenced in <html:code>/etc/rsyslog.conf</html:code>, run the following command to
inspect the file's permissions:
<html:pre>$ ls -l <html:i>LOGFILE</html:i></html:pre>
If the permissions are not 600 or more restrictive, run the following
command to correct this:
<html:pre>$ sudo chmod 0600 <html:i>LOGFILE</html:i></html:pre>"</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001314</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.5.2</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Log files can contain valuable information regarding system
configuration. If the system log files are not protected unauthorized
users could change the logged data, eliminating their forensic value.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:fix id="rsyslog_files_permissions" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

# List of log file paths to be inspected for correct permissions
# * Primarily inspect log file paths listed in /etc/rsyslog.conf
RSYSLOG_ETC_CONFIG="/etc/rsyslog.conf"
# * And also the log file paths listed after rsyslog's $IncludeConfig directive
#   (store the result into array for the case there's shell glob used as value of IncludeConfig)
readarray -t RSYSLOG_INCLUDE_CONFIG &lt; &lt;(grep -e "\$IncludeConfig[[:space:]]\+[^[:space:];]\+" /etc/rsyslog.conf | cut -d ' ' -f 2)
readarray -t RSYSLOG_INCLUDE &lt; &lt;(awk '/)/{f=0} /include\(/{f=1} f{nf=gensub("^(include\\(|\\s*)file=\"(\\S+)\".*","\\2",1); if($0!=nf){print nf}}' /etc/rsyslog.conf)

# Declare an array to hold the final list of different log file paths
declare -a LOG_FILE_PATHS

declare -a RSYSLOG_CONFIGS
RSYSLOG_CONFIGS=(${RSYSLOG_CONFIGS[@]} ${RSYSLOG_ETC_CONFIG})
RSYSLOG_CONFIGS=(${RSYSLOG_CONFIGS[@]} ${RSYSLOG_INCLUDE_CONFIG[@]})
RSYSLOG_CONFIGS=(${RSYSLOG_CONFIGS[@]} ${RSYSLOG_INCLUDE[@]})

# Browse each file selected above as containing paths of log files
# ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' in the default configuration)
for LOG_FILE in "${RSYSLOG_CONFIGS[@]}"
do
	# From each of these files extract just particular log file path(s), thus:
	# * Ignore lines starting with space (' '), comment ('#"), or variable syntax ('$') characters,
	# * Ignore empty lines,
	# * Strip quotes and closing brackets from paths.
	# * Ignore paths that match /dev|/etc.*\.conf, as those are paths, but likely not log files
	# * From the remaining valid rows select only fields constituting a log file path
	# Text file column is understood to represent a log file path if and only if all of the following are met:
	# * it contains at least one slash '/' character,
	# * it is preceded by space
	# * it doesn't contain space (' '), colon (':'), and semicolon (';') characters
	# Search log file for path(s) only in case it exists!
	if [[ -f "${LOG_FILE}" ]]
	then
		NORMALIZED_CONFIG_FILE_LINES=$(sed -e "/^[#|$]/d" "${LOG_FILE}")
		LINES_WITH_PATHS=$(grep '[^/]*\s\+\S*/\S\+$' &lt;&lt;&lt; "${NORMALIZED_CONFIG_FILE_LINES}")
		FILTERED_PATHS=$(sed -e 's/[^\/]*[[:space:]]*\([^:;[:space:]]*\)/\1/g' &lt;&lt;&lt; "${LINES_WITH_PATHS}")
		CLEANED_PATHS=$(sed -e "s/[\"')]//g; /\\/etc.*\.conf/d; /\\/dev\\//d" &lt;&lt;&lt; "${FILTERED_PATHS}")
		MATCHED_ITEMS=$(sed -e "/^$/d" &lt;&lt;&lt; "${CLEANED_PATHS}")
		# Since above sed command might return more than one item (delimited by newline), split the particular
		# matches entries into new array specific for this log file
		readarray -t ARRAY_FOR_LOG_FILE &lt;&lt;&lt; "$MATCHED_ITEMS"
		# Concatenate the two arrays - previous content of $LOG_FILE_PATHS array with
		# items from newly created array for this log file
		LOG_FILE_PATHS+=("${ARRAY_FOR_LOG_FILE[@]}")
		# Delete the temporary array
		unset ARRAY_FOR_LOG_FILE
	fi
done

DESIRED_PERM_MOD=600

# Correct the form o
for LOG_FILE_PATH in "${LOG_FILE_PATHS[@]}"
do
	# Sanity check - if particular $LOG_FILE_PATH is empty string, skip it from further processing
	if [ -z "$LOG_FILE_PATH" ]
	then
		continue
	fi

	# Also for each log file check if its permissions differ from 600. If so, correct them
	if [ -f "$LOG_FILE_PATH" ] &amp;&amp; [ "$(/usr/bin/stat -c %a "$LOG_FILE_PATH")" -ne $DESIRED_PERM_MOD ]
	then
		/bin/chmod $DESIRED_PERM_MOD "$LOG_FILE_PATH"
	fi
done

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-rsyslog_files_permissions:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_log_rotation">
            <xccdf-1.2:title xml:lang="en-US">Ensure All Logs are Rotated by logrotate</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">
Edit the file <html:code>/etc/logrotate.d/syslog</html:code>. Find the first

line, which should look like this (wrapped for clarity):
<html:pre>/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler \
  /var/log/boot.log /var/log/cron {</html:pre>
Edit this line so that it contains a one-space-separated
listing of each log file referenced in <html:code>/etc/rsyslog.conf</html:code>.
<html:br/><html:br/>
All logs in use on a system must be rotated regularly, or the
log files will consume disk space over time, eventually interfering
with system operation. The file <html:code>/etc/logrotate.d/syslog</html:code> is the
configuration file used by the <html:code>logrotate</html:code> program to maintain all
log files written by <html:code>syslog</html:code>. By default, it rotates logs weekly and
stores four archival copies of each log. These settings can be
modified by editing <html:code>/etc/logrotate.conf</html:code>, but the defaults are
sufficient for purposes of this guide.
<html:br/><html:br/>
Note that <html:code>logrotate</html:code> is run nightly by the cron job
<html:code>/etc/cron.daily/logrotate</html:code>. If particularly active logs need to be
rotated more often than once a day, some other mechanism must be
used.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Ensure Logrotate Runs Periodically</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>logrotate</html:code> utility allows for the automatic rotation of
log files.  The frequency of rotation is specified in <html:code>/etc/logrotate.conf</html:code>,
which triggers a cron task.  To configure logrotate to run daily, add or correct
the following line in <html:code>/etc/logrotate.conf</html:code>:
<html:pre># rotate log files <html:i>frequency</html:i>
daily</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R43)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">NT12(R18)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000366</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.7</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Log files that are not properly rotated run the risk of growing so large
that they fill up the /var/log partition. Valuable logging information could be lost
if the /var/log partition becomes full.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:fix id="ensure_logrotate_activated" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

LOGROTATE_CONF_FILE="/etc/logrotate.conf"
CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate"

# daily rotation is configured
grep -q "^daily$" $LOGROTATE_CONF_FILE|| echo "daily" &gt;&gt; $LOGROTATE_CONF_FILE

# remove any line configuring weekly, monthly or yearly rotation
sed -i '/^\s*\(weekly\|monthly\|yearly\).*$/d' $LOGROTATE_CONF_FILE

# configure cron.daily if not already
if ! grep -q "^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" $CRON_DAILY_LOGROTATE_FILE; then
	echo "#!/bin/sh" &gt; $CRON_DAILY_LOGROTATE_FILE
	echo "/usr/sbin/logrotate $LOGROTATE_CONF_FILE" &gt;&gt; $CRON_DAILY_LOGROTATE_FILE
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="ensure_logrotate_activated" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Configure daily log rotation in /etc/logrotate.conf
  lineinfile:
    create: true
    dest: /etc/logrotate.conf
    regexp: ^daily$
    line: daily
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Make sure daily log rotation setting is not overriden in /etc/logrotate.conf
  lineinfile:
    create: false
    dest: /etc/logrotate.conf
    regexp: ^[\s]*(weekly|monthly|yearly)$
    state: absent
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure cron.daily if not already
  block:

    - name: Add shebang
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: '#!/bin/sh'
        insertbefore: BOF
        create: true

    - name: Add logrotate call
      lineinfile:
        path: /etc/cron.daily/logrotate
        line: /usr/sbin/logrotate /etc/logrotate.conf
        regexp: ^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.7
    - configure_strategy
    - ensure_logrotate_activated
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="ensure_logrotate_activated" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here.
        mode: 0644
        path: /etc/logrotate.conf
        overwrite: true
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-ensure_logrotate_activated:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_accepting_remote_messages">
            <xccdf-1.2:title xml:lang="en-US">Configure rsyslogd to Accept Remote Messages If Acting as a Log Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">By default, <html:code>rsyslog</html:code> does not listen over the network
for log messages. If needed, modules can be enabled to allow
the rsyslog daemon to receive messages from other systems and for the system
thus to act as a log server.
If the system is not a log server, then lines concerning these modules
should remain commented out.
<html:br/><html:br/></xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rsyslog_sending_messages">
            <xccdf-1.2:title xml:lang="en-US">Rsyslog Logs Sent To Remote Host</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If system logs are to be useful in detecting malicious
activities, it is necessary to send logs to a remote server. An
intruder who has compromised the root account on a system may
delete the log entries which indicate that the system was attacked
before they are seen by an administrator.
<html:br/><html:br/>
However, it is recommended that logs be stored on the local
host in addition to being sent to the loghost, especially if
<html:code>rsyslog</html:code> has been configured to use the UDP protocol to send
messages over a network. UDP does not guarantee reliable delivery,
and moderately busy sites will lose log messages occasionally,
especially in periods of high traffic which may be the result of an
attack. In addition, remote <html:code>rsyslog</html:code> messages are not
authenticated in any way by default, so it is easy for an attacker to
introduce spurious messages to the central log server. Also, some
problems cause loss of network connectivity, which will prevent the
sending of messages to the central server. For all of these reasons, it is
better to store log messages both centrally and on each host, so
that they can be correlated if necessary.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Remote Log Server</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify an URI or IP address of a remote host where the log messages will be sent and stored.</xccdf-1.2:description>
              <xccdf-1.2:value>logcollector</xccdf-1.2:value>
            </xccdf-1.2:Value>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network">
          <xccdf-1.2:title xml:lang="en-US">Network Configuration and Firewalls</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Most systems must be connected to a network of some
sort, and this brings with it the substantial risk of network
attack. This section discusses the security impact of decisions
about networking which must be made when configuring a system.
<html:br/><html:br/>
This section also discusses firewalls, network access
controls, and other network security frameworks, which allow
system-level rules to be written that can limit an attackers' ability
to connect to your system. These rules can specify that network
traffic should be allowed or denied from certain IP addresses,
hosts, and networks. The rules can also specify which of the
system's network services are available to particular hosts or
networks.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-firewalld">
            <xccdf-1.2:title xml:lang="en-US">firewalld</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The dynamic firewall daemon <html:code>firewalld</html:code> provides a
dynamically managed firewall with support for network “zones” to assign
a level of trust to a network and its associated connections and interfaces.
It has support for IPv4 and IPv6 firewall settings. It supports Ethernet
bridges and has a separation of runtime and permanent configuration options.
It also has an interface for services or applications to add firewall rules
directly.
<html:br/>
A graphical configuration tool, <html:code>firewall-config</html:code>, is used to configure
<html:code>firewalld</html:code>, which in turn uses <html:code>iptables</html:code> tool to communicate
with <html:code>Netfilter</html:code> in the kernel which implements packet filtering.
<html:br/>
The firewall service provided by <html:code>firewalld</html:code> is dynamic rather than
static because changes to the configuration can be made at anytime and are
immediately implemented. There is no need to save or apply the changes. No
unintended disruption of existing network connections occurs as no part of
the firewall has to be reloaded.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_firewalld_activation">
              <xccdf-1.2:title xml:lang="en-US">Inspect and Activate Default firewalld Rules</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Firewalls can be used to separate networks into different zones
based on the level of trust the user has decided to place on the devices and
traffic within that network. <html:code>NetworkManager</html:code> informs firewalld to which
zone an interface belongs. An interface's assigned zone can be changed by
<html:code>NetworkManager</html:code> or via the <html:code>firewall-config</html:code> tool.
<html:br/>
The zone settings in <html:code>/etc/firewalld/</html:code> are a range of preset settings
which can be quickly applied to a network interface. These are the zones
provided by firewalld sorted according to the default trust level of the
zones from untrusted to trusted:
<html:ul><html:li><html:code>drop</html:code><html:br/><html:p>Any incoming network packets are dropped, there is no
reply. Only outgoing network connections are possible.</html:p></html:li><html:li><html:code>block</html:code><html:br/><html:p>Any incoming network connections are rejected with an
<html:code>icmp-host-prohibited</html:code> message for IPv4 and <html:code>icmp6-adm-prohibited</html:code>
for IPv6. Only network connections initiated from within the system are
possible.</html:p></html:li><html:li><html:code>public</html:code><html:br/><html:p>For use in public areas. You do not trust the other
computers on the network to not harm your computer. Only selected incoming
connections are accepted.</html:p></html:li><html:li><html:code>external</html:code><html:br/><html:p>For use on external networks with masquerading enabled
especially for routers. You do not trust the other computers on the network to
not harm your computer. Only selected incoming connections are accepted.</html:p></html:li><html:li><html:code>dmz</html:code><html:br/><html:p>For computers in your demilitarized zone that are
publicly-accessible with limited access to your internal network. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>work</html:code><html:br/><html:p>For use in work areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>home</html:code><html:br/><html:p>For use in home areas. You mostly trust the other computers
on networks to not harm your computer. Only selected incoming connections are
accepted.</html:p></html:li><html:li><html:code>internal</html:code><html:br/><html:p>For use on internal networks. You mostly trust the
other computers on the networks to not harm your computer. Only selected
incoming connections are accepted.</html:p></html:li><html:li><html:code>trusted</html:code><html:br/><html:p>All network connections are accepted.</html:p></html:li></html:ul>
<html:br/>
It is possible to designate one of these zones to be the default zone. When
interface connections are added to <html:code>NetworkManager</html:code>, they are assigned
to the default zone. On installation, the default zone in firewalld is set to
be the public zone.
<html:br/>
To find out all the settings of a zone, for example the <html:code>public zone,</html:code>
enter the following command as root:
<html:pre># firewall-cmd --zone=public --list-all</html:pre>
Example output of this command might look like the following:
<html:pre>
# firewall-cmd --zone=public --list-all
public
  interfaces:
  services: mdns dhcpv6-client ssh
  ports:
  forward-ports:
  icmp-blocks: source-quench
</html:pre>
To view the network zones currently active, enter the following command as root:
<html:pre># firewall-cmd --get-service</html:pre>
The following listing displays the result of this command
on common Fedora system:
<html:pre>
# firewall-cmd --get-service
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp
high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd
ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn
pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind
samba samba-client smtp ssh telnet tftp tftp-client transmission-client
vnc-server wbem-https
</html:pre>
Finally to view the network zones that will be active after the next firewalld
service reload, enter the following command as root:
<html:pre># firewall-cmd --get-service --permanent</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ruleset_modifications">
              <xccdf-1.2:title xml:lang="en-US">Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in configuration files under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/><html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the <html:code>firewall-cmd</html:code> program to load in rules under the <html:code>/etc/firewalld/services</html:code>
and <html:code>/etc/firewalld/zones</html:code> directories.
<html:br/><html:br/>
Instructions apply to both unless otherwise noted. Language and address
conventions for regular firewalld rules are used throughout this section.</xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">The program <html:code>firewall-config</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts the <html:code>firewalld</html:code> ruleset(s).</xccdf-1.2:warning>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipsec">
            <xccdf-1.2:title xml:lang="en-US">IPSec Support</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Support for Internet Protocol Security (IPsec)
is provided with Libreswan.</xccdf-1.2:description>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_package_libreswan_installed" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Install libreswan Package</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The Libreswan package provides an implementation of IPsec
and IKE, which permits the creation of secure tunnels over
untrusted networks. The <html:code>libreswan</html:code> package can be installed with the following command:
<html:pre>
$ sudo dnf install libreswan</html:pre></xccdf-1.2:description>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001130</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001131</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 3.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 7.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.15.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.MA-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000480-GPOS-00227</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000120-GPOS-00061</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Providing the ability for remote users or systems
to initiate a secure VPN connection protects information when it is
transmitted over a wide area network.</xccdf-1.2:rationale>
              <xccdf-1.2:fix id="package_libreswan_installed" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable">
if ! rpm -q --quiet "libreswan" ; then
    dnf install -y "libreswan"
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="package_libreswan_installed" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Ensure libreswan is installed
  package:
    name: libreswan
    state: present
  tags:
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-4.1
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - package_libreswan_installed
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="package_libreswan_installed" system="urn:xccdf:fix:script:puppet" complexity="low" disruption="low" strategy="enable">include install_libreswan

class install_libreswan {
  package { 'libreswan':
    ensure =&gt; 'installed',
  }
}
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="package_libreswan_installed" system="urn:redhat:anaconda:pre" complexity="low" disruption="low" strategy="enable">
package --add=libreswan
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="package_libreswan_installed" system="urn:redhat:osbuild:blueprint">
[[packages]]
name = "libreswan"
version = "*"
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-content-ref name="oval:ssg-package_libreswan_installed:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-iptables">
            <xccdf-1.2:title xml:lang="en-US">iptables and ip6tables</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">A host-based firewall called <html:code>netfilter</html:code> is included as
part of the Linux kernel distributed with the system. It is
activated by default. This firewall is controlled by the program
<html:code>iptables</html:code>, and the entire capability is frequently referred to by
this name. An analogous program called <html:code>ip6tables</html:code> handles filtering
for IPv6.
<html:br/><html:br/>
Unlike TCP Wrappers, which depends on the network server
program to support and respect the rules written, <html:code>netfilter</html:code>
filtering occurs at the kernel level, before a program can even
process the data from the network packet. As such, any program on
the system is affected by the rules written.
<html:br/><html:br/>
This section provides basic information about strengthening
the <html:code>iptables</html:code> and <html:code>ip6tables</html:code> configurations included with the system.
For more complete information that may allow the construction of a
sophisticated ruleset tailored to your environment, please consult
the references at the end of this section.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_activation">
              <xccdf-1.2:title xml:lang="en-US">Inspect and Activate Default Rules</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">View the currently-enforced <html:code>iptables</html:code> rules by running
the command:
<html:pre>$ sudo iptables -nL --line-numbers</html:pre>
The command is analogous for <html:code>ip6tables</html:code>.
<html:br/><html:br/>
If the firewall does not appear to be active (i.e., no rules
appear), activate it and ensure that it starts at boot by issuing
the following commands (and analogously for <html:code>ip6tables</html:code>):
<html:pre>$ sudo service iptables restart</html:pre>
The default iptables rules are:
<html:pre>Chain INPUT (policy ACCEPT)
num  target     prot opt source       destination
1    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0    state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0    0.0.0.0/0
3    ACCEPT     all  --  0.0.0.0/0    0.0.0.0/0
4    ACCEPT     tcp  --  0.0.0.0/0    0.0.0.0/0    state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source       destination
1    REJECT     all  --  0.0.0.0/0    0.0.0.0/0    reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source       destination</html:pre>
The <html:code>ip6tables</html:code> default rules are essentially the same.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_ruleset_modifications">
              <xccdf-1.2:title xml:lang="en-US">Strengthen the Default Ruleset</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default rules can be strengthened. The system
scripts that activate the firewall rules expect them to be defined
in the configuration files <html:code>iptables</html:code> and <html:code>ip6tables</html:code> in the directory
<html:code>/etc/sysconfig</html:code>. Many of the lines in these files are similar
to the command line arguments that would be provided to the programs
<html:code>/sbin/iptables</html:code> or <html:code>/sbin/ip6tables</html:code> - but some are quite
different.
<html:br/><html:br/>
The following recommendations describe how to strengthen the
default ruleset configuration file. An alternative to editing this
configuration file is to create a shell script that makes calls to
the iptables program to load in rules, and then invokes service
iptables save to write those loaded rules to
<html:code>/etc/sysconfig/iptables.</html:code>
<html:br/><html:br/>
The following alterations can be made directly to
<html:code>/etc/sysconfig/iptables</html:code> and <html:code>/etc/sysconfig/ip6tables</html:code>.
Instructions apply to both unless otherwise noted. Language and address
conventions for regular iptables are used throughout this section;
configuration for ip6tables will be either analogous or explicitly
covered.</xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">The program <html:code>system-config-securitylevel</html:code>
allows additional services to penetrate the default firewall rules
and automatically adjusts <html:code>/etc/sysconfig/iptables</html:code>. This program
is only useful if the default ruleset meets your security
requirements. Otherwise, this program should not be used to make
changes to the firewall configuration because it re-writes the
saved configuration file.</xccdf-1.2:warning>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_icmp_disabled">
                <xccdf-1.2:title xml:lang="en-US">Restrict ICMP Message Types</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">In <html:code>/etc/sysconfig/iptables</html:code>, the accepted ICMP messages
types can be restricted. To accept only ICMP echo reply, destination
unreachable, and time exceeded messages, remove the line:<html:br/>
<html:pre>-A INPUT -p icmp --icmp-type any -j ACCEPT</html:pre>
and insert the lines:
<html:pre>-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT</html:pre>
To allow the system to respond to pings, also insert the following line:
<html:pre>-A INPUT -p icmp --icmp-type echo-request -j ACCEPT</html:pre>
Ping responses can also be limited to certain networks or hosts by using the -s
option in the previous rule.  Because IPv6 depends so heavily on ICMPv6, it is
preferable to deny the ICMPv6 packets you know you don't need (e.g. ping
requests) in <html:code>/etc/sysconfig/ip6tables</html:code>, while letting everything else
through:
<html:pre>-A INPUT -p icmpv6 --icmpv6-type echo-request -j DROP</html:pre>
If you are going to statically configure the system's address, it should
ignore Router Advertisements which could add another IPv6 address to the
interface or alter important network settings:
<html:pre>-A INPUT -p icmpv6 --icmpv6-type router-advertisement -j DROP</html:pre>
Restricting ICMPv6 message types in <html:code>/etc/sysconfig/ip6tables</html:code> is not
recommended because the operation of IPv6 depends heavily on ICMPv6. Thus, great
care must be taken if any other ICMPv6 types are blocked.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_iptables_log_and_drop_suspicious">
                <xccdf-1.2:title xml:lang="en-US">Log and Drop Packets with Suspicious Source Addresses</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Packets with non-routable source addresses should be rejected, as they may indicate spoofing. Because the
modified policy will reject non-matching packets, you only need to add these rules if you are interested in also
logging these spoofing or suspicious attempts before they are dropped. If you do choose to log various suspicious
traffic, add identical rules with a target of <html:code>DROP</html:code> after each <html:i>LOG</html:i>.
To log and then drop these IPv4 packets, insert the following rules in <html:code>/etc/sysconfig/iptables</html:code> (excepting
any that are intentionally used):
<html:pre>-A INPUT -s 10.0.0.0/8 -j LOG --log-prefix "IP DROP SPOOF A: "
-A INPUT -s 172.16.0.0/12 -j LOG --log-prefix "IP DROP SPOOF B: "
-A INPUT -s 192.168.0.0/16 -j LOG --log-prefix "IP DROP SPOOF C: "
-A INPUT -s 224.0.0.0/4 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s 240.0.0.0/5 -j LOG --log-prefix "IP DROP SPOOF E: "
-A INPUT -d 127.0.0.0/8 -j LOG --log-prefix "IP DROP LOOPBACK: "</html:pre>
Similarly, you might wish to log packets containing some IPv6 reserved addresses if they are not expected
on your network:
<html:pre>-A INPUT -i eth0 -s ::1 -j LOG --log-prefix "IPv6 DROP LOOPBACK: "
-A INPUT -s 2002:E000::/20 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:7F00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0000::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:FF00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:0A00::/24 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:AC10::/28 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "
-A INPUT -s 2002:C0A8::/32 -j LOG --log-prefix "IPv6 6to4 TRAFFIC: "</html:pre>
If you are not expecting to see site-local multicast or auto-tunneled traffic, you can log those:
<html:pre>-A INPUT -s FF05::/16 -j LOG --log-prefix "IPv6 SITE-LOCAL MULTICAST: "
-A INPUT -s ::0.0.0.0/96 -j LOG --log-prefix "IPv4 COMPATIBLE IPv6 ADDR: "</html:pre>
If you wish to block multicasts to all link-local nodes (e.g. if you are not using router auto-configuration and
do not plan to have any services that multicast to the entire local network), you can block the link-local
all-nodes multicast address (before accepting incoming ICMPv6):
<html:pre>-A INPUT -d FF02::1 -j LOG --log-prefix "Link-local All-Nodes Multicast: "</html:pre>
However, if you're going to allow IPv4 compatible IPv6 addresses (of the form ::0.0.0.0/96), you should
then consider logging the non-routable IPv4-compatible addresses:
<html:pre>-A INPUT -s ::0.0.0.0/104 -j LOG --log-prefix "IP NON-ROUTABLE ADDR: "
-A INPUT -s ::127.0.0.0/104 -j LOG --log-prefix "IP DROP LOOPBACK: "
-A INPUT -s ::224.0.0.0.0/100 -j LOG --log-prefix "IP DROP MULTICAST D: "
-A INPUT -s ::255.0.0.0/104 -j LOG --log-prefix "IP BROADCAST: "</html:pre>
If you are not expecting to see any IPv4 (or IPv4-compatible) traffic on your network, consider logging it before it gets dropped:
<html:pre>-A INPUT -s ::FFFF:0.0.0.0/96 -j LOG --log-prefix "IPv4 MAPPED IPv6 ADDR: "
-A INPUT -s 2002::/16 -j LOG --log-prefix "IPv6 6to4 ADDR: "</html:pre>
The following rule will log all traffic originating from a site-local address, which is deprecated address space:
<html:pre>-A INPUT -s FEC0::/10 -j LOG --log-prefix "SITE-LOCAL ADDRESS TRAFFIC: "</html:pre></xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-ipv6">
            <xccdf-1.2:title xml:lang="en-US">IPv6</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The system includes support for Internet Protocol
version 6. A major and often-mentioned improvement over IPv4 is its
enormous increase in the number of available addresses. Another
important feature is its support for automatic configuration of
many network settings.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_ipv6">
              <xccdf-1.2:title xml:lang="en-US">Disable Support for IPv6 Unless Needed</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Despite configuration that suggests support for IPv6 has
been disabled, link-local IPv6 address auto-configuration occurs
even when only an IPv4 address is assigned. The only way to
effectively prevent execution of the IPv6 networking stack is to
instruct the system not to activate the IPv6 kernel module.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configuring_ipv6">
              <xccdf-1.2:title xml:lang="en-US">Configure IPv6 Settings if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">A major feature of IPv6 is the extent to which systems
implementing it can automatically configure their networking
devices using information from the network. From a security
perspective, manually configuring important configuration
information is preferable to accepting it from the network
in an unauthenticated fashion.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value" type="string">
                <xccdf-1.2:title xml:lang="en-US">IPV6_AUTOCONF</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Toggle global IPv6 auto-configuration (only, if global
forwarding is disabled)</xccdf-1.2:description>
                <xccdf-1.2:value>no</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">no</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">yes</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept all router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Toggle ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Toggle IPv6 Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.all.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept all router solicitations?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_ra_defrtr</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept default router in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_ra_pinfo</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept prefix information in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_ra_rtr_pref</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept router preference in router advertisements?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_ra</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept default router advertisements by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Toggle ICMP Redirect Acceptance By Default</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.autoconf</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable auto configuration on IPv6 interfaces</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.forwarding</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Toggle IPv6 default Forwarding</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.max_addresses</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Maximum number of autoconfigured IPv6 addresses</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv6.conf.default.router_solicitations</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Accept all router solicitations by default?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_ipv6_limit_requests">
                <xccdf-1.2:title xml:lang="en-US">Limit Network-Transmitted Configuration if Using Static IPv6 Addresses</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">To limit the configuration information requested from other
systems and accepted from the network on a system that uses
statically-configured IPv6 addresses, add the following lines to
<html:code>/etc/sysctl.conf</html:code>:
<html:pre>net.ipv6.conf.default.router_solicitations = 0
net.ipv6.conf.default.accept_ra_rtr_pref = 0
net.ipv6.conf.default.accept_ra_pinfo = 0
net.ipv6.conf.default.accept_ra_defrtr = 0
net.ipv6.conf.default.autoconf = 0
net.ipv6.conf.default.dad_transmits = 0
net.ipv6.conf.default.max_addresses = 1</html:pre>
The <html:code>router_solicitations</html:code> setting determines how many router
solicitations are sent when bringing up the interface. If addresses are
statically assigned, there is no need to send any solicitations.
<html:br/><html:br/>
The <html:code>accept_ra_pinfo</html:code> setting controls whether the system will accept
prefix info from the router.
<html:br/><html:br/>
The <html:code>accept_ra_defrtr</html:code> setting controls whether the system will accept
Hop Limit settings from a router advertisement. Setting it to 0 prevents a
router from changing your default IPv6 Hop Limit for outgoing packets.
<html:br/><html:br/>
The <html:code>autoconf</html:code> setting controls whether router advertisements can cause
the system to assign a global unicast address to an interface.
<html:br/><html:br/>
The <html:code>dad_transmits</html:code> setting determines how many neighbor solicitations
to send out per address (global and link-local) when bringing up an interface
to ensure the desired address is unique on the network.
<html:br/><html:br/>
The <html:code>max_addresses</html:code> setting determines how many global unicast IPv6
addresses can be assigned to each interface.  The default is 16, but it should
be set to exactly the number of statically configured global addresses
required.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-kernel">
            <xccdf-1.2:title xml:lang="en-US">Kernel Parameters Which Affect Networking</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>sysctl</html:code> utility is used to set
parameters which affect the operation of the Linux kernel. Kernel parameters
which affect networking and have security implications are described here.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_and_router_parameters">
              <xccdf-1.2:title xml:lang="en-US">Network Related Kernel Runtime Parameters for Hosts and Routers</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Certain kernel parameters should be set for systems which are
acting as either hosts or routers to improve the system's ability defend
against certain types of IPv4 protocol attacks.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.all.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Disable ICMP Redirect Acceptance</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.all.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Trackers could be using source-routed packets to
generate traffic that seems to be intra-net, but actually was
created outside and has been redirected.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.all.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.all.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to enforce sanity checking, also called ingress
filtering or egress filtering. The point is to drop a packet if the
source and destination IP addresses in the IP header do not make
sense when considered in light of the physical interface on which
it arrived.</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.all.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packets on all interfaces.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.default.accept_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Disable ICMP Redirect Acceptance?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.default.accept_source_route</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Disable IP source routing?</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.default.log_martians</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Disable so you don't Log Spoofed Packets, Source
Routed Packets, Redirect Packets</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.default.rp_filter</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enables source route verification</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.conf.default.secure_redirects</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to prevent hijacking of routing path by only
allowing redirects from gateways known in routing
table. Disable to refuse acceptance of secure ICMP redirected packages by default.</xccdf-1.2:description>
                <xccdf-1.2:value>0</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.icmp_echo_ignore_broadcasts</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Ignore all ICMP ECHO and TIMESTAMP requests sent to it
via broadcast/multicast</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.icmp_ignore_bogus_error_responses</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to prevent unnecessary logging</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.tcp_invalid_ratelimit</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Configure  the maximal rate for sending duplicate acknowledgments in
response to incoming invalid TCP packets.</xccdf-1.2:description>
                <xccdf-1.2:value>500</xccdf-1.2:value>
                <xccdf-1.2:value selector="one_thousand">1000</xccdf-1.2:value>
                <xccdf-1.2:value selector="five_hundred">500</xccdf-1.2:value>
                <xccdf-1.2:value selector="two_hundred_fifty">250</xccdf-1.2:value>
                <xccdf-1.2:value selector="one_hundred">100</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.tcp_rfc1337</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to enable TCP behavior conformant with RFC 1337</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value" type="number">
                <xccdf-1.2:title xml:lang="en-US">net.ipv4.tcp_syncookies</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enable to turn on TCP SYN Cookie
Protection</xccdf-1.2:description>
                <xccdf-1.2:value>1</xccdf-1.2:value>
                <xccdf-1.2:value selector="disabled">0</xccdf-1.2:value>
                <xccdf-1.2:value selector="enabled">1</xccdf-1.2:value>
              </xccdf-1.2:Value>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_host_parameters">
              <xccdf-1.2:title xml:lang="en-US">Network Parameters for Hosts Only</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the system is not going to be used as a router, then setting certain
kernel parameters ensure that the host will not perform routing
of network traffic.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-susefirewall2">
            <xccdf-1.2:title xml:lang="en-US">SuSEfirewall2</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The SuSEfirewall2 provides a managed firewall.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-uncommon">
            <xccdf-1.2:title xml:lang="en-US">Uncommon Network Protocols</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The system includes support for several network protocols which are not commonly used.
Although security vulnerabilities in kernel networking code are not frequently discovered,
the consequences can be dramatic. Ensuring uncommon network protocols are disabled
reduces the system's risk to attacks targeted at its implementation of those protocols.</xccdf-1.2:description>
            <xccdf-1.2:warning xml:lang="en-US" category="general">Although these protocols are not commonly used, avoid disruption
in your network environment by ensuring they are not needed
prior to disabling them.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network-wireless">
            <xccdf-1.2:title xml:lang="en-US">Wireless Networking</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Wireless networking, such as 802.11
(WiFi) and Bluetooth, can present a security risk to sensitive or
classified systems and networks. Wireless networking hardware is
much more likely to be included in laptop or portable systems than
in desktops or servers. 
<html:br/><html:br/>
Removal of hardware provides the greatest assurance that the wireless
capability remains disabled. Acquisition policies often include provisions to
prevent the purchase of equipment that will be used in sensitive spaces and
includes wireless capabilities. If it is impractical to remove the wireless
hardware, and policy permits the device to enter sensitive spaces as long
as wireless is disabled, efforts should instead focus on disabling wireless capability
via software.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_wireless_software">
              <xccdf-1.2:title xml:lang="en-US">Disable Wireless Through Software Configuration</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If it is impossible to remove the wireless hardware
from the device in question, disable as much of it as possible
through software. The following methods can disable software
support for wireless networking, but note that these methods do not
prevent malicious software or careless users from re-activating the
devices.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_disable_unused_interfaces">
            <xccdf-1.2:title xml:lang="en-US">Disable Unused Interfaces</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Network interfaces expand the attack surface of the
system.  Unused interfaces are not monitored or controlled, and
should be disabled.
<html:br/><html:br/>
If the system does not require network communications but still
needs to use the loopback interface, remove all files of the form
<html:code>ifcfg-<html:i>interface</html:i></html:code> except for <html:code>ifcfg-lo</html:code> from
<html:code>/etc/sysconfig/network-scripts</html:code>:
<html:pre>$ sudo rm /etc/sysconfig/network-scripts/ifcfg-<html:i>interface</html:i></html:pre>
If the system is a standalone machine with no need for network access or even
communication over the loopback device, then disable this service.

The <html:code>network</html:code> service can be disabled with the following command:
<html:pre>$ sudo systemctl mask --now network.service</html:pre></xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_network_ssl">
            <xccdf-1.2:title xml:lang="en-US">Transport Layer Security Support</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Support for Transport Layer Security (TLS), and its predecessor, the Secure
Sockets Layer (SSL), is included in Red Hat Enterprise Linux in the OpenSSL software (RPM package
<html:code>openssl</html:code>).  TLS provides encrypted and authenticated network
communications, and many network services include support for it.  TLS or SSL
can be leveraged to avoid any plaintext transmission of sensitive data.
<html:br/>
For information on how to use OpenSSL, see
<html:b><html:a href="http://www.openssl.org/docs/">http://www.openssl.org/docs/</html:a></html:b>.  Information on FIPS validation
of OpenSSL is available at <html:b><html:a href="http://www.openssl.org/docs/fips.html">http://www.openssl.org/docs/fips.html</html:a></html:b>
and <html:b><html:a href="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm">http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm</html:a></html:b>.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions">
          <xccdf-1.2:title xml:lang="en-US">File Permissions and Masks</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Traditional Unix security relies heavily on file and
directory permissions to prevent unauthorized users from reading or
modifying files to which they should not have access.
<html:br/><html:br/>
Several of the commands in this section search filesystems
for files or directories with certain characteristics, and are
intended to be run on every local partition on a given system.
When the variable <html:i>PART</html:i> appears in one of the commands below,
it means that the command is intended to be run repeatedly, with the
name of each local partition substituted for <html:i>PART</html:i> in turn.
<html:br/><html:br/>
The following command prints a list of all xfs partitions on the local
system, which is the default filesystem for Fedora
installations:
<html:pre>$ mount -t xfs | awk '{print $3}'</html:pre>
For any systems that use a different
local filesystem type, modify this command as appropriate.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_files">
            <xccdf-1.2:title xml:lang="en-US">Verify Permissions on Important Files and
Directories</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses important
permission restrictions which can be verified
to ensure that no harmful discrepancies have
arisen.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_important_account_files">
              <xccdf-1.2:title xml:lang="en-US">Verify Permissions on Files with Local Account Information and Credentials</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default restrictive permissions for files which act as
important security databases such as <html:code>passwd</html:code>, <html:code>shadow</html:code>,
<html:code>group</html:code>, and <html:code>gshadow</html:code> files must be maintained.  Many utilities
need read access to the <html:code>passwd</html:code> file in order to function properly, but
read access to the <html:code>shadow</html:code> file allows malicious attacks against system
passwords, and should never be enabled.</xccdf-1.2:description>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Group Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the group owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/group</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_groupowner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_groupowner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/group
  file:
    path: /etc/group
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Group Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the group owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_groupowner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Group Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the group owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chgrp root /etc/shadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/shadow</html:code> file stores password hashes. Protection of this file is
critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chgrp 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_groupowner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure group owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    group: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_groupowner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_groupowner_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_group" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify User Who Owns group File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the owner of <html:code>/etc/group</html:code>, run the command: <html:pre>$ sudo chown root /etc/group </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_owner_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_owner_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/group
  file:
    path: /etc/group
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify User Who Owns passwd File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the owner of <html:code>/etc/passwd</html:code>, run the command: <html:pre>$ sudo chown root /etc/passwd </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/passwd</html:code> file contains information about the users that are configured on
the system. Protection of this file is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_owner_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_owner_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/passwd
  file:
    path: /etc/passwd
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify User Who Owns shadow File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US"> To properly set the owner of <html:code>/etc/shadow</html:code>, run the command: <html:pre>$ sudo chown root /etc/shadow </html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_owner_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chown 0 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_owner_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure owner 0 on /etc/shadow
  file:
    path: /etc/shadow
    owner: '0'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_owner_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_owner_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Permissions on group File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">
To properly set the permissions of <html:code>/etc/passwd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/group</html:code> file contains information regarding groups that are configured
on the system. Protection of this file is important for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_permissions_etc_group" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/group
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_permissions_etc_group" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/group
  stat:
    path: /etc/group
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/group
  file:
    path: /etc/group
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_group
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Permissions on passwd File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">
To properly set the permissions of <html:code>/etc/passwd</html:code>, run the command:
<html:pre>$ sudo chmod 0644 /etc/passwd</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">If the <html:code>/etc/passwd</html:code> file is writable by a group-owner or the
world the risk of its compromise is increased. The file contains the list of
accounts on the system and associated information, and protection of this file
is critical for system security.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0644 /etc/passwd
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_permissions_etc_passwd" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/passwd
  stat:
    path: /etc/passwd
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0644 on /etc/passwd
  file:
    path: /etc/passwd
    mode: '0644'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_passwd
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
              <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" selected="false" role="full" severity="medium">
                <xccdf-1.2:title xml:lang="en-US">Verify Permissions on shadow File</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">
To properly set the permissions of <html:code>/etc/shadow</html:code>, run the command:
<html:pre>$ sudo chmod 0000 /etc/shadow</html:pre></xccdf-1.2:description>
                <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R36)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO01.06</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.02</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 5.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.10.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.1.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.11.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.13.2.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.3.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.8.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-003-3 R5.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R2.3</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.1</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1.2</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-6(1)</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.DS-5</xccdf-1.2:reference>
                <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.7.c</xccdf-1.2:reference>
                <xccdf-1.2:rationale xml:lang="en-US">The <html:code>/etc/shadow</html:code> file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture.</xccdf-1.2:rationale>
                <xccdf-1.2:fix id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="configure">

chmod 0000 /etc/shadow
</xccdf-1.2:fix>
                <xccdf-1.2:fix id="file_permissions_etc_shadow" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: Test for existence /etc/shadow
  stat:
    path: /etc/shadow
  register: file_exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Ensure permission 0000 on /etc/shadow
  file:
    path: /etc/shadow
    mode: '0000'
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
    - CJIS-5.5.2.2
    - NIST-800-53-AC-6(1)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-8.7.c
    - configure_strategy
    - file_permissions_etc_shadow
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
                <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                  <xccdf-1.2:check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="ssg-fedora-oval.xml"/>
                </xccdf-1.2:check>
                <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                  <xccdf-1.2:check-content-ref name="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
                </xccdf-1.2:check>
              </xccdf-1.2:Rule>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_var_log_dir">
              <xccdf-1.2:title xml:lang="en-US">Verify Permissions on Files within /var/log Directory</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>/var/log</html:code> directory contains files with logs of error
messages in the system and should only be accessed by authorized
personnel.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_within_important_dirs">
              <xccdf-1.2:title xml:lang="en-US">Verify File Permissions Within Some Important Directories</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Some directories contain files whose confidentiality or integrity
is notably important and may also be susceptible to misconfiguration over time, particularly if
unpackaged software is installed. As such,
an argument exists to verify that files' permissions within these directories remain
configured correctly and restrictively.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting">
            <xccdf-1.2:title xml:lang="en-US">Restrict Dynamic Mounting and Unmounting of
Filesystems</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<html:br/><html:br/>
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<html:pre>$ find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</html:pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <html:code>/etc/modprobe.d</html:code>.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_partitions">
            <xccdf-1.2:title xml:lang="en-US">Restrict Partition Mount Options</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">System partitions can be mounted with certain options
that limit what files on those partitions can do. These options
are set in the <html:code>/etc/fstab</html:code> configuration file, and can be
used to make certain types of malicious behavior more difficult.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_removable_partition" type="string">
              <xccdf-1.2:title xml:lang="en-US">Removable Partition</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">This value is used by the checks mount_option_nodev_removable_partitions, mount_option_nodev_removable_partitions,
and mount_option_nodev_removable_partitions to ensure that the correct mount options are set on partitions mounted from
removable media such as CD-ROMs, USB keys, and floppy drives. This value should be modified to reflect any removable
partitions that are required on the local system.</xccdf-1.2:description>
              <xccdf-1.2:value selector="dev_cdrom">/dev/cdrom</xccdf-1.2:value>
            </xccdf-1.2:Value>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_permissions_local">
            <xccdf-1.2:title xml:lang="en-US">Verify Permissions on Important Files and
Directories Are Configured in /etc/permissions.local</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Permissions for many files on a system must be set
restrictively to ensure sensitive information is properly protected.
This section discusses the <html:code>/etc/permissions.local</html:code> file, where
expected permissions can be configured to be checked and fixed through
usage of the <html:code>chkstat</html:code> command.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrictions">
            <xccdf-1.2:title xml:lang="en-US">Restrict Programs from Dangerous Execution Patterns</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The recommendations in this section are designed to
ensure that the system's features to protect against potentially
dangerous program execution are activated.
These protections are applied at the system initialization or
kernel level, and defend against certain types of badly-configured
or compromised programs.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_coredumps">
              <xccdf-1.2:title xml:lang="en-US">Disable Core Dumps</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">A core dump file is the memory image of an executable
program when it was terminated by the operating system due to
errant behavior. In most cases, only software developers
legitimately need to access these files. The core dump files may
also contain sensitive information, or unnecessarily occupy large
amounts of disk space.
<html:br/><html:br/>
Once a hard limit is set in <html:code>/etc/security/limits.conf</html:code>, or
to a file within the <html:code>/etc/security/limits.d/</html:code> directory, a
user cannot increase that limit within his or her own session. If access
to core dumps is required, consider restricting them to only
certain users or groups. See the <html:code>limits.conf</html:code> man page for more
information.
<html:br/><html:br/>
The core dumps of setuid programs are further protected. The
<html:code>sysctl</html:code> variable <html:code>fs.suid_dumpable</html:code> controls whether
the kernel allows core dumps from these programs at all. The default
value of 0 is recommended.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_daemon_umask">
              <xccdf-1.2:title xml:lang="en-US">Daemon Umask</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The umask is a per-process setting which limits
the default permissions for creation of new files and directories.
The system includes initialization scripts which set the default umask
for system daemons.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_umask_for_daemons" type="string">
                <xccdf-1.2:title xml:lang="en-US">daemon umask</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enter umask for daemons</xccdf-1.2:description>
                <xccdf-1.2:value selector="022">022</xccdf-1.2:value>
                <xccdf-1.2:value selector="027">027</xccdf-1.2:value>
                <xccdf-1.2:value>022</xccdf-1.2:value>
              </xccdf-1.2:Value>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_execshield_settings">
              <xccdf-1.2:title xml:lang="en-US">Enable ExecShield</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">ExecShield describes kernel features that provide
protection against exploitation of memory corruption errors such as buffer
overflows. These features include random placement of the stack and other
memory regions, prevention of execution in memory that should only hold data,
and special handling of text buffers. These protections are enabled by default
on 32-bit systems and controlled through <html:code>sysctl</html:code> variables 
<html:code>kernel.exec-shield</html:code> and <html:code>kernel.randomize_va_space</html:code>. On the latest
64-bit systems, <html:code>kernel.exec-shield</html:code> cannot be enabled or disabled with 
<html:code>sysctl</html:code>.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_enable_nx">
              <xccdf-1.2:title xml:lang="en-US">Enable Execute Disable (XD) or No Execute (NX) Support on
x86 Systems</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Recent processors in the x86 family support the
ability to prevent code execution on a per memory page basis.
Generically and on AMD processors, this ability is called No
Execute (NX), while on Intel processors it is called Execute
Disable (XD). This ability can help prevent exploitation of buffer
overflow vulnerabilities and should be activated whenever possible.
Extra steps must be taken to ensure that this protection is
enabled, particularly on 32-bit x86 systems. Other processors, such
as Itanium and POWER, have included such support since inception
and the standard kernel for those platforms supports the
feature. This is enabled by default on the latest Red Hat and 
Fedora systems if supported by the hardware.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_poisoning">
              <xccdf-1.2:title xml:lang="en-US">Memory Poisoning</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Memory Poisoning consists of writing a special value to uninitialized or freed memory.
Poisoning can be used as a mechanism to prevent leak of information and detection of
corrupted memory.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux">
          <xccdf-1.2:title xml:lang="en-US">SELinux</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">SELinux is a feature of the Linux kernel which can be
used to guard against misconfigured or compromised programs.
SELinux enforces the idea that programs should be limited in what
files they can access and what actions they can take.
<html:br/><html:br/>
The default SELinux policy, as configured on Fedora, has been
sufficiently developed and debugged that it should be usable on
almost any system with minimal configuration and a small
amount of system administrator training. This policy prevents
system services - including most of the common network-visible
services such as mail servers, FTP servers, and DNS servers - from
accessing files which those services have no valid reason to
access. This action alone prevents a huge amount of possible damage
from network attacks against services, from trojaned software, and
so forth.
<html:br/><html:br/>
This guide recommends that SELinux be enabled using the
default (targeted) policy on every Fedora system, unless that
system has unusual requirements which make a stronger policy
appropriate.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_policy_name" type="string">
            <xccdf-1.2:title xml:lang="en-US">SELinux policy</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Type of policy in use. Possible values are:
<html:br/>targeted - Only targeted network daemons are protected.
<html:br/>strict - Full SELinux protection.
<html:br/>mls - Multiple levels of security</xccdf-1.2:description>
            <xccdf-1.2:value>targeted</xccdf-1.2:value>
            <xccdf-1.2:value selector="mls">mls</xccdf-1.2:value>
            <xccdf-1.2:value selector="targeted">targeted</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinux_state" type="string">
            <xccdf-1.2:title xml:lang="en-US">SELinux state</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">enforcing - SELinux security policy is enforced.
<html:br/>permissive - SELinux prints warnings instead of enforcing.
<html:br/>disabled - SELinux is fully disabled.</xccdf-1.2:description>
            <xccdf-1.2:value>enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="disabled">disabled</xccdf-1.2:value>
            <xccdf-1.2:value selector="enforcing">enforcing</xccdf-1.2:value>
            <xccdf-1.2:value selector="permissive">permissive</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_selinux-booleans">
            <xccdf-1.2:title xml:lang="en-US">SELinux - Booleans</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Enable or Disable runtime customization of SELinux system policies
without having to reload or recompile the SELinux policy.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">abrt_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_handle_event" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">abrt_handle_event SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">abrt_upload_watch_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">antivirus_can_scan_system SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_antivirus_use_jit" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">antivirus_use_jit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_auditadm_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">auditadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">authlogin_nsswitch_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_radius" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">authlogin_radius SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_authlogin_yubikey" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">authlogin_yubikey SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">awstats_purge_apache_log_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_boinc_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">boinc_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cdrecord_read_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cdrecord_read_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cluster_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cluster_manage_all_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cluster_use_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cluster_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cobbler_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cobbler_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cobbler_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cobbler_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">collectd_tcp_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">condor_tcp_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_conman_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">conman_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_container_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">container_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_can_relabel" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cron_can_relabel SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cron_system_cronjob_use_shares SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cron_userdomain_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cups_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cups_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_cvs_read_shadow" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">cvs_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_dump_core" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">daemons_dump_core SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">daemons_enable_cluster_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">daemons_use_tcp_wrapper SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_daemons_use_tty" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">daemons_use_tty SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">dbadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">dbadm_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">dbadm_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_deny_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">deny_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_deny_ptrace" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">deny_ptrace SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">dhcpc_exec_iptables SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">dhcpd_use_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_domain_fd_use" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">domain_fd_use SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">domain_kernel_load_modules SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_entropyd_use_audio" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">entropyd_use_audio SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_can_connect_db" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">exim_can_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_manage_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">exim_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_exim_read_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">exim_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fcron_crond" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">fcron_crond SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">fenced_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fenced_can_ssh" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">fenced_can_ssh SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_fips_mode" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">fips_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_connect_all_unreserved SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_connect_db" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_full_access" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_full_access SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ftpd_use_passive_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_cgi_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_cgi_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_cgi_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_session_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_session_users" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_session_users SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_system_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_system_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_git_system_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">git_system_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gitosis_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_api_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">glance_api_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_use_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">glance_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_glance_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">glance_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_global_ssp" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">global_ssp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gluster_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gluster_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gluster_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gpg_web_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_gssd_read_tmp" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">gssd_read_tmp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_guest_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">guest_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_haproxy_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">haproxy_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_builtin_scripting SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_check_spam SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_connect_ftp SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_connect_ldap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_connect_mythtv SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_connect_zabbix SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_network_connect_cobbler SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_network_connect_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_network_memcache SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_network_relay SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_dbus_avahi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_dbus_sssd SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_dontaudit_search_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_enable_cgi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_enable_ftp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_graceful_shutdown SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_manage_ipa SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_mod_auth_ntlm_winbind SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_mod_auth_pam SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_read_user_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_read_user_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_ipa" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_run_ipa SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_run_preupgrade SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_run_stickshift SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_serve_cobbler_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_setrlimit" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_setrlimit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_ssi_exec SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_sys_script_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_tmp_exec SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_tty_comm" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_tty_comm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_unified" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_unified SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_gpg" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_gpg SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_openstack" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_openstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_use_sasl" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_use_sasl SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_verify_dns" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">httpd_verify_dns SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">icecast_use_any_tcp_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">irc_use_any_tcp_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_irssi_use_full_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">irssi_use_full_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">kdumpgui_run_bootloader SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_kerberos_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">kerberos_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ksmtuned_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ksmtuned_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logadm_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logging_syslogd_can_sendmail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logging_syslogd_run_nagios_plugins SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logging_syslogd_use_tty SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_login_console_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">login_console_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logrotate_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">logwatch_can_network_connect_mail SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">lsmd_plugin_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mailman_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_client" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mcelog_client SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mcelog_exec_scripts SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_foreground" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mcelog_foreground SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mcelog_server" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mcelog_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">minidlna_read_generic_user_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mmap_low_allowed" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mmap_low_allowed SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mock_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mount_anyfile" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mount_anyfile SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_plugin_bind_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_plugin_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_plugin_use_bluejeans SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_plugin_use_gps SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_plugin_use_spice SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mozilla_read_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mozilla_read_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mpd_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mpd_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mpd_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mpd_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mplayer_execstack" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mplayer_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_mysql_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">mysql_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nagios_run_pnp4nagios SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nagios_run_sudo" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nagios_run_sudo SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">named_tcp_bind_http_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_named_write_master_zones" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">named_write_master_zones SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_neutron_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">neutron_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nfs_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nfs_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nfsd_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nfsd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nis_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nis_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_nscd_use_shm" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">nscd_use_shm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openshift_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">openshift_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">openvpn_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">openvpn_enable_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">openvpn_run_unconfined SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">pcp_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">pcp_read_generic_logs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">piranha_lvs_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polipo_connect_all_unreserved SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polipo_session_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_session_users" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polipo_session_users SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_use_cifs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polipo_use_cifs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polipo_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polipo_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">polyinstantiation_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">postfix_local_write_mail_spool SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">postgresql_can_rsync SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">postgresql_selinux_transmit_client_label SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">postgresql_selinux_unconfined_dbadm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">postgresql_selinux_users_ddl SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pppd_can_insmod" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">pppd_can_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_pppd_for_user" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">pppd_for_user SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_privoxy_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">privoxy_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">prosody_bind_http_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">puppetagent_manage_all_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">puppetmaster_use_db SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_racoon_read_shadow" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">racoon_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">rsync_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_client" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">rsync_client SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">rsync_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rsync_full_access" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">rsync_full_access SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_create_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_domain_controller" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_domain_controller SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_enable_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_ro" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_export_all_ro SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_export_all_rw" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_export_all_rw SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_load_libgfapi SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_portmapper" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_portmapper SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_run_unconfined" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_run_unconfined SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_share_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_share_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_samba_share_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">samba_share_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sanlock_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sanlock_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sanlock_use_samba" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sanlock_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">saslauthd_read_shadow SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secadm_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">secadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">secure_mode SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode_insmod" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">secure_mode_insmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_secure_mode_policyload" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">secure_mode_policyload SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_direct_dri_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_execheap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_execmod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_execstack SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_mysql_connect_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_ping" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_ping SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_postgresql_connect_enabled SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_rw_noexattrfile SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_share_music SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_tcp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_udp_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">selinuxuser_use_ssh_chroot SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sge_domain_can_network_connect SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sge_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sge_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smartmon_3ware" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">smartmon_3ware SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_smbd_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">smbd_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spamassassin_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">spamassassin_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">spamd_enable_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_squid_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">squid_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_squid_use_tproxy" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">squid_use_tproxy SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ssh_chroot_rw_homedirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_keysign" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ssh_keysign SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">ssh_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_staff_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">staff_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_staff_use_svirt" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">staff_use_svirt SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_swift_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">swift_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sysadm_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">sysadm_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">telepathy_connect_all_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">telepathy_tcp_connect_generic_network_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftp_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tftp_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftp_home_dir" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tftp_home_dir SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tmpreaper_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tmpreaper_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tor_bind_all_unreserved_ports SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tor_can_network_relay" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">tor_can_network_relay SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">unconfined_chrome_sandbox_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_login" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">unconfined_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">unconfined_mozilla_plugin_transition SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">unprivuser_use_svirt SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">use_ecryptfs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">use_fusefs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_lpd_server" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">use_lpd_server SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">use_nfs_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">use_samba_home_dirs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_user_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">user_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_varnishd_connect_any" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">varnishd_connect_any SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_read_qemu_ga_data SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_rw_qemu_ga_data SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_sandbox_use_all_caps SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_sandbox_use_audit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_sandbox_use_mknod SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_sandbox_use_netlink SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_sandbox_use_sys_admin SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_transition_userdomain SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_comm" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_comm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_fusefs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_fusefs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_rawip" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_rawip SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_samba" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_samba SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_sanlock" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_sanlock SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_usb" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_usb SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_virt_use_xserver" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">virt_use_xserver SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">webadm_manage_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_webadm_read_user_files" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">webadm_read_user_files SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">wine_mmap_zero_ignore SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xdm_bind_vnc_tcp_port SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xdm_exec_bootloader SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xdm_sysadm_login SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xdm_write_home" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xdm_write_home SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xen_use_nfs" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xen_use_nfs SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xend_run_blktap" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xend_run_blktap SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xend_run_qemu" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xend_run_qemu SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_connect_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xguest_connect_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_exec_content" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xguest_exec_content SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_mount_media" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xguest_mount_media SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xguest_use_bluetooth SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>true</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xserver_clients_write_xshm SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_execmem" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xserver_execmem SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_xserver_object_manager" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">xserver_object_manager SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zabbix_can_network" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">zabbix_can_network SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">zarafa_setrlimit SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zebra_write_config" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">zebra_write_config SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">zoneminder_anon_write SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo" type="boolean">
              <xccdf-1.2:title xml:lang="en-US">zoneminder_run_sudo SELinux Boolean</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">default - Default SELinux boolean setting.
<html:br/>on - SELinux boolean is enabled.
<html:br/>off - SELinux boolean is disabled.</xccdf-1.2:description>
              <xccdf-1.2:value>false</xccdf-1.2:value>
              <xccdf-1.2:value selector="off">false</xccdf-1.2:value>
              <xccdf-1.2:value selector="on">true</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_services">
        <xccdf-1.2:title xml:lang="en-US">Services</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US">The best protection against vulnerable software is running less software. This section describes how to review
the software which Fedora installs on a system and disable software which is not needed. It
then enumerates the software packages installed on a default Fedora system and provides guidance about which
ones can be safely disabled.
<html:br/><html:br/>
Fedora provides a convenient minimal install option that essentially installs the bare necessities for a functional
system. When building Fedora systems, it is highly recommended to select the minimal packages and then build up
the system from there.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apport">
          <xccdf-1.2:title xml:lang="en-US">Apport Service</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Apport service provides debugging and crash reporting
features on Ubuntu distributions.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_apt">
          <xccdf-1.2:title xml:lang="en-US">APT service configuration</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The apt service manage the package management and update of the whole system. Its configuration need to be properly defined to ensure efficient security updates, packages and repository authentication and proper lifecycle management.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi">
          <xccdf-1.2:title xml:lang="en-US">Avahi Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Avahi daemon implements the DNS Service Discovery
and Multicast DNS protocols, which provide service and host
discovery on a network. It allows a system to automatically
identify resources on the network, such as printers or web servers.
This capability is also known as mDNSresponder and is a major part
of Zeroconf networking.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_avahi_configuration">
            <xccdf-1.2:title xml:lang="en-US">Configure Avahi if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If your system requires the Avahi daemon, its configuration can be restricted
to improve security. The Avahi daemon configuration file is
<html:code>/etc/avahi/avahi-daemon.conf</html:code>. The following security recommendations
should be applied to this file:
See the <html:code>avahi-daemon.conf(5)</html:code> man page, or documentation at

    <html:a href="http://www.avahi.org">http://www.avahi.org</html:a>, for more detailed information
about the configuration options.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disable_avahi_group">
            <xccdf-1.2:title xml:lang="en-US">Disable Avahi Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Because the Avahi daemon service keeps an open network
port, it is subject to network attacks.
Disabling it can reduce the system's vulnerability to such attacks.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_base">
          <xccdf-1.2:title xml:lang="en-US">Base Services</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">This section addresses the base services that are installed on a
Fedora default installation which are not covered in other
sections. Some of these services listen on the network and
should be treated with particular discretion. Other services are local
system utilities that may or may not be extraneous. In general, system services
should be disabled if not required.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_cron_and_at">
          <xccdf-1.2:title xml:lang="en-US">Cron and At Daemons</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The cron and at services are used to allow commands to
be executed at a later time. The cron service is required by almost
all systems to perform necessary maintenance tasks, while at may or
may not be required on a given system. Both daemons should be
configured defensively.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_restrict_at_cron_users">
            <xccdf-1.2:title xml:lang="en-US">Restrict at and cron to Authorized Users if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>/etc/cron.allow</html:code> and <html:code>/etc/at.allow</html:code> files contain lists of
users who are allowed to use <html:code>cron</html:code> and at to delay execution of
processes. If these files exist and if the corresponding files
<html:code>/etc/cron.deny</html:code> and <html:code>/etc/at.deny</html:code> do not exist, then only users
listed in the relevant allow files can run the crontab and <html:code>at</html:code> commands
to submit jobs to be run at scheduled intervals. On many systems, only the
system administrator needs the ability to schedule jobs. Note that even if a
given user is not listed in <html:code>cron.allow</html:code>, cron jobs can still be run as
that user. The <html:code>cron.allow</html:code> file controls only administrative access
to the crontab command for scheduling and modifying cron jobs.
<html:br/>
<html:br/>
To restrict <html:code>at</html:code> and <html:code>cron</html:code> to only authorized users:
<html:ul><html:li>Remove the <html:code>cron.deny</html:code> file:<html:pre>$ sudo rm /etc/cron.deny</html:pre></html:li><html:li>Edit <html:code>/etc/cron.allow</html:code>, adding one line for each user allowed to use
the crontab command to create cron jobs.</html:li><html:li>Remove the <html:code>at.deny</html:code> file:<html:pre>$ sudo rm /etc/at.deny</html:pre></html:li><html:li>Edit <html:code>/etc/at.allow</html:code>, adding one line for each user allowed to use
the at command to create at jobs.</html:li></html:ul></xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_deprecated">
          <xccdf-1.2:title xml:lang="en-US">Deprecated services</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Some deprecated software services impact the overall system security due to their behavior (leak of
confidentiality in network exchange, usage as uncontrolled communication channel, risk associated with the service due to its old age, etc.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp">
          <xccdf-1.2:title xml:lang="en-US">DHCP</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Dynamic Host Configuration Protocol (DHCP) allows
systems to request and obtain an IP address and other configuration
parameters from a server.
<html:br/><html:br/>
This guide recommends configuring networking on clients by manually editing
the appropriate files under <html:code>/etc/sysconfig</html:code>.  Use of DHCP can make client 
systems vulnerable to compromise by rogue DHCP servers, and should be avoided 
unless necessary.  If using DHCP is necessary, however, there are best practices 
that should be followed to minimize security risk.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_client_configuration">
            <xccdf-1.2:title xml:lang="en-US">Configure DHCP Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If DHCP must be used, then certain configuration changes can
minimize the amount of information it receives and applies from the network,
and thus the amount of incorrect information a rogue DHCP server could
successfully distribute.  For more information on configuring dhclient, see the
<html:code>dhclient(8)</html:code> and <html:code>dhclient.conf(5)</html:code> man pages.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dhcp_server_configuration">
            <xccdf-1.2:title xml:lang="en-US">Configure DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If the system must act as a DHCP server, the configuration
information it serves should be minimized. Also, support for other protocols
and DNS-updating schemes should be explicitly disabled unless needed. The
configuration file for dhcpd is called <html:code>/etc/dhcp/dhcpd.conf</html:code>. The file
begins with a number of global configuration options. The remainder of the file
is divided into sections, one for each block of addresses offered by dhcpd,
each of which contains configuration options specific to that address
block.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_client">
            <xccdf-1.2:title xml:lang="en-US">Disable DHCP Client</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">DHCP is the default network configuration method provided by the system
installer, and common on many networks. Nevertheless, manual management
of IP addresses for systems implies a greater degree of management and
accountability for network activity.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dhcp_server">
            <xccdf-1.2:title xml:lang="en-US">Disable DHCP Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The DHCP server <html:code>dhcpd</html:code> is not installed or activated by
default. If the software was installed and activated, but the
system does not need to act as a DHCP server, it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns">
          <xccdf-1.2:title xml:lang="en-US">DNS Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Most organizations have an operational need to run at
least one nameserver. However, there are many common attacks
involving DNS server software, and this server software should
be disabled on any system
on which it is not needed.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dns_server">
            <xccdf-1.2:title xml:lang="en-US">Disable DNS Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">DNS software should be disabled on any systems which does not
need to be a nameserver. Note that the BIND DNS server software is
not installed on Fedora by default. The remainder of this section
discusses secure configuration of systems which must be
nameservers.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_isolation">
            <xccdf-1.2:title xml:lang="en-US">Isolate DNS from Other Services</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This section discusses mechanisms for preventing the DNS server
from interfering with other services. This is done both to protect the
remainder of the network should a nameserver be compromised, and to make direct
attacks on nameservers more difficult.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_chroot">
              <xccdf-1.2:title xml:lang="en-US">Run DNS Software in a chroot Jail</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Install the <html:code>bind-chroot</html:code> package:
<html:pre>$ sudo yum install bind-chroot</html:pre>
Place a valid named.conf file inside the chroot jail:
<html:pre>$ sudo cp /etc/named.conf /var/named/chroot/etc/named.conf
$ sudo chown root:root /var/named/chroot/etc/named.conf
$ sudo chmod 644 /var/named/chroot/etc/named.conf</html:pre>
Create and populate an appropriate zone directory within the jail, based on the
options directive. If your <html:code>named.conf</html:code> includes:
<html:pre>options {
directory "/path/to/DIRNAME ";
...
}</html:pre>
then copy that directory and its contents from the original zone directory:
<html:pre>$ sudo cp -r /path/to/DIRNAME /var/named/chroot/DIRNAME</html:pre>
Add or correct the following line within <html:code>/etc/sysconfig/named</html:code>:
<html:pre>ROOTDIR=/var/named/chroot</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">If you are running BIND in a chroot jail, then you
should use the jailed <html:code>named.conf</html:code> as the primary nameserver
configuration file. That is, when this guide recommends editing
<html:code>/etc/named.conf</html:code>, you should instead edit
<html:code>/var/named/chroot/etc/named.conf</html:code>.</xccdf-1.2:warning>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_dedicated">
              <xccdf-1.2:title xml:lang="en-US">Run DNS Software on Dedicated Servers</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Since DNS is
a high-risk service which must frequently be made available to the entire
Internet, it is strongly recommended that no other services be offered by
systems which act as organizational DNS servers.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_protection">
            <xccdf-1.2:title xml:lang="en-US">Protect DNS Data from Tampering or Attack</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This section discusses DNS configuration options which make it
more difficult for attackers to gain access to private DNS data or to modify
DNS data.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_partition_with_views">
              <xccdf-1.2:title xml:lang="en-US">Use Views to Partition External and Internal Information</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If it is not possible to run external and internal nameservers on
separate physical systems, run BIND9 and simulate this feature using views.
Edit <html:code>/etc/named.conf</html:code>. Add or correct the following directives (where
SUBNET is the numerical IP representation of your organization in the form
xxx.xxx.xxx.xxx/xx):
<html:pre>acl internal {
  SUBNET ;
  localhost;
};
view "internal-view" {
  match-clients { internal; };
  zone "." IN {
    type hint;
    file "db.cache";
  };
  zone "internal.example.com " IN {
    ...
  };
};

view "external-view" {
  match-clients { any; };
  recursion no;
  zone "example.com " IN {
    ...
  };
};</html:pre></xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="general">As shown in the example, database files which are
required for recursion, such as the root hints file, must be available to any
clients which are allowed to make recursive queries. Under typical
circumstances, this includes only the internal clients which are allowed to use
this server as a general-purpose nameserver.</xccdf-1.2:warning>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dns_server_separate_internal_external">
              <xccdf-1.2:title xml:lang="en-US">Run Separate DNS Servers for External and Internal Queries</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Is it possible to run external and internal nameservers on
separate systems? If so, follow the configuration guidance in this section. On
the external nameserver, edit <html:code>/etc/named.conf</html:code> to add or correct the
following directives:
<html:pre>options {
  allow-query { any; };
  recursion no;
  ...
};
zone "example.com " IN {
  ...
};</html:pre>
On the internal nameserver, edit <html:code>/etc/named.conf</html:code>. Add or correct the
following directives, where SUBNET is the numerical IP representation of your
organization in the form xxx.xxx.xxx.xxx/xx:
<html:pre>acl internal {
  SUBNET ;
  localhost;
};
options {
  allow-query { internal; };
  ...
};
zone "internal.example.com " IN {
  ...
};</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_docker">
          <xccdf-1.2:title xml:lang="en-US">Docker Service</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The docker service is necessary to create containers, which are
  self-sufficient and self-contained applications using the resource
  isolation features of the kernel.</xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_fapolicyd">
          <xccdf-1.2:title xml:lang="en-US">Application Whitelisting Daemon</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Fapolicyd (File Access Policy Daemon) implements application whitelisting
to decide file access rights. Applications that are known via a reputation
source are allowed access while unknown applications are not. The daemon
makes use of the kernel's <html:code>fanotify</html:code> interface to determine file access rights.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp">
          <xccdf-1.2:title xml:lang="en-US">FTP Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">FTP is a common method for allowing remote access to
files. Like telnet, the FTP protocol is unencrypted, which means
that passwords and other data transmitted during the session can be
captured and that the session is vulnerable to hijacking.
Therefore, running the FTP server software is not recommended.
<html:br/><html:br/>
However, there are some FTP server configurations which may
be appropriate for some environments, particularly those which
allow only read-only anonymous access as a means of downloading
data available to the public.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_vsftpd">
            <xccdf-1.2:title xml:lang="en-US">Disable vsftpd if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">To minimize attack surface, disable vsftpd if at all
possible.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_configure_vsftpd">
            <xccdf-1.2:title xml:lang="en-US">Configure vsftpd to Provide FTP Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The primary vsftpd configuration file is
<html:code>/etc/vsftpd.conf</html:code>, if that file exists, or
<html:code>/etc/vsftpd/vsftpd.conf</html:code> if it does not.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_restrict_users">
              <xccdf-1.2:title xml:lang="en-US">Restrict the Set of Users Allowed to Access FTP</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">This section describes how to disable non-anonymous (password-based) FTP logins, or, if it is not possible to
do this entirely due to legacy applications, how to restrict insecure FTP login to only those users who have an
identified need for this access.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ftp_use_vsftpd">
            <xccdf-1.2:title xml:lang="en-US">Use vsftpd to Provide FTP Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If your use-case requires FTP service, install and
set-up vsftpd to provide it.</xccdf-1.2:description>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_http">
          <xccdf-1.2:title xml:lang="en-US">Web Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The web server is responsible for providing access to
content via the HTTP protocol. Web servers represent a significant
security risk because:
<html:br/><html:br/>
<html:ul><html:li>The HTTP port is commonly probed by malicious sources</html:li><html:li>Web server software is very complex, and includes a long
history of vulnerabilities</html:li><html:li>The HTTP protocol is unencrypted and vulnerable to passive
monitoring</html:li></html:ul>
<html:br/><html:br/>
The system's default web server software is Apache 2 and is
provided in the RPM package <html:code>httpd</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_httpd">
            <xccdf-1.2:title xml:lang="en-US">Disable Apache if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If Apache was installed and activated, but the system
does not need to act as a web server, then it should be disabled
and removed from the system.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_installing_httpd">
            <xccdf-1.2:title xml:lang="en-US">Install Apache if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If <html:code>httpd</html:code> was not installed and activated, but the system
needs to act as a web server, then it should be installed on the system. Follow these
guidelines to install it defensively. The <html:code>httpd</html:code> package can be installed with
the following command:
<html:pre>$ sudo yum install httpd</html:pre>
This method of installation is recommended over installing the "Web Server"
package group during the system installation process. The Web Server package
group includes many packages which are likely extraneous, while the
command-line method installs only the required <html:code>httpd</html:code> package itself.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimal_modules_installed">
              <xccdf-1.2:title xml:lang="en-US">Confirm Minimal Built-in Modules Installed</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The default <html:code>httpd</html:code> installation minimizes the number of
modules that are compiled directly into the binary (<html:code>core prefork http_core
mod_so</html:code>). This minimizes risk by limiting the capabilities allowed by the
web server.

Query the set of compiled-in modules using the following command:
<html:pre>$ httpd -l</html:pre>
If the number of compiled-in modules is significantly larger than the
aforementioned set, this guide recommends re-installing <html:code>httpd</html:code> with a
reduced configuration. Minimizing the number of modules that are compiled into
the <html:code>httpd</html:code> binary, reduces risk by limiting the capabilities allowed by
the webserver.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_securing_httpd">
            <xccdf-1.2:title xml:lang="en-US">Secure Apache Configuration</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>httpd</html:code> configuration file is
<html:code>/etc/httpd/conf/httpd.conf</html:code>. Apply the recommendations in the remainder
of this section to this file.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_httpd_loglevel" type="string">
              <xccdf-1.2:title xml:lang="en-US">HTTPD Log Level</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for LogLevel in /etc/httpd/conf/httpd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="alert">alert</xccdf-1.2:value>
              <xccdf-1.2:value selector="crit">crit</xccdf-1.2:value>
              <xccdf-1.2:value>warn</xccdf-1.2:value>
              <xccdf-1.2:value selector="emerg">emerg</xccdf-1.2:value>
              <xccdf-1.2:value selector="error">error</xccdf-1.2:value>
              <xccdf-1.2:value selector="warn">warn</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_max_keepalive_requests" type="number">
              <xccdf-1.2:title xml:lang="en-US">Maximum KeepAlive Requests for HTTPD</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for MaxKeepAliveRequests in httpd.conf</xccdf-1.2:description>
              <xccdf-1.2:value selector="100">100</xccdf-1.2:value>
              <xccdf-1.2:value selector="1000">1000</xccdf-1.2:value>
              <xccdf-1.2:value selector="10000">10000</xccdf-1.2:value>
              <xccdf-1.2:value selector="100000">100000</xccdf-1.2:value>
              <xccdf-1.2:value selector="500">500</xccdf-1.2:value>
              <xccdf-1.2:value>100</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_os_protect_web_server">
              <xccdf-1.2:title xml:lang="en-US">Configure Operating System to Protect Web Server</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The following configuration steps should be taken on the system which hosts the
web server, in order to provide as safe an environment as possible for the web server.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_chroot">
                <xccdf-1.2:title xml:lang="en-US">Run httpd in a chroot Jail if Practical</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Running <html:code>httpd</html:code> inside a <html:code>chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Fedora) provide the <html:code>ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code>/chroot/apache</html:code>, add the following line to
<html:code>/etc/httpd/conf/httpd.conf</html:code>: <html:pre>ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code>httpd</html:code> inside
<html:code>/chroot/apache</html:code> , including <html:code>httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_restrict_file_dir_access">
                <xccdf-1.2:title xml:lang="en-US">Restrict File and Directory Access</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Minimize access to critical <html:code>httpd</html:code> files and directories.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_perl_securely">
              <xccdf-1.2:title xml:lang="en-US">Configure PERL Securely</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">PERL (Practical Extraction and Report Language) is an interpreted language
optimized for scanning arbitrary text files, extracting information from those
text files, and printing reports based on that information. The language is
often used in shell scripting and is intended to be practical, easy to use, and
efficient means of generating interactive web pages for the user.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_configure_php_securely">
              <xccdf-1.2:title xml:lang="en-US">Configure PHP Securely</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">PHP is a widely-used and often misconfigured server-side scripting language. It should
be used with caution, but configured appropriately when needed.
<html:br/><html:br/>
Review <html:code>/etc/php.ini</html:code> and make the following changes if possible:
<html:pre># Do not expose PHP error messages to external users
display_errors = Off

# Enable safe mode
safe_mode = On

# Only allow access to executables in isolated directory
safe_mode_exec_dir = php-required-executables-path

# Limit external access to PHP environment
safe_mode_allowed_env_vars = PHP_

# Restrict PHP information leakage
expose_php = Off

# Log all errors
log_errors = On

# Do not register globals for input data
register_globals = Off

# Minimize allowable PHP post size
post_max_size = 1K

# Ensure PHP redirects appropriately
cgi.force_redirect = 0

# Disallow uploading unless necessary
file_uploads = Off

# Disallow treatment of file requests as fopen calls
allow_url_fopen = Off

# Enable SQL safe mode
sql.safe_mode = On
</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_directory_restrictions">
              <xccdf-1.2:title xml:lang="en-US">Directory Restrictions</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The Directory tags in the web server configuration file allow finer grained access
control for a specified directory. All web directories should be configured on a
case-by-case basis, allowing access only where needed.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimize_loadable_modules">
              <xccdf-1.2:title xml:lang="en-US">Minimize Web Server Loadable Modules</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">A default installation of <html:code>httpd</html:code> includes a plethora of dynamically shared objects (DSO)
that are loaded at run-time. Unlike the aforementioned compiled-in modules, a DSO can be
disabled in the configuration file by removing the corresponding LoadModule directive.
<html:br/><html:br/>
Note: A DSO only provides additional functionality if associated directives are included
in the <html:code>httpd</html:code> configuration file. It should also be noted that removing a DSO will produce
errors on <html:code>httpd</html:code> startup if the configuration file contains directives that apply to that
module. Refer to <html:code><html:a href="http://httpd.apache.org/docs/">http://httpd.apache.org/docs/</html:a></html:code> for details on which directives
are associated with each DSO.
<html:br/><html:br/>
Following each DSO removal, the configuration can be tested with the following command
to check if everything still works:
<html:pre>$ sudo service httpd configtest</html:pre>
The purpose of each of the modules loaded by default will now be addressed one at a time.
If none of a module's directives are being used, remove it.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_core_modules">
                <xccdf-1.2:title xml:lang="en-US">httpd Core Modules</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">These modules comprise a basic subset of modules that are likely needed for base <html:code>httpd</html:code>
functionality; ensure they are not commented out in <html:code>/etc/httpd/conf/httpd.conf</html:code>:
<html:pre>LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
LoadModule authz_default_module modules/mod_authz_default.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mome.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule alias_module modules/mod_alias.so</html:pre>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</xccdf-1.2:description>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_basic_authentication">
                  <xccdf-1.2:title xml:lang="en-US">Minimize Modules for HTTP Basic Authentication</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The following modules are necessary if this web server will provide content that will
be restricted by a password.
<html:br/><html:br/>
Authentication can be performed using local plain text password files (<html:code>authn_file</html:code>),
local DBM password files (<html:code>authn_dbm</html:code>) or an LDAP directory. The only module required by
the web server depends on your choice of authentication. Comment out the modules you don't
need from the following:
<html:pre>LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authn_dbm_module modules/mod_authn_dbm.so</html:pre>
<html:code>authn_alias</html:code> allows for authentication based on aliases. <html:code>authn_anon</html:code>
allows anonymous authentication similar to that of anonymous ftp sites. <html:code>authz_owner</html:code>
allows authorization based on file ownership. <html:code>authz_dbm</html:code> allows for authorization
based on group membership if the web server is using DBM authentication.
<html:br/><html:br/>
If the above functionality is unnecessary, comment out the related module:
<html:pre>#LoadModule authn_alias_module modules/mod_authn_alias.so
#LoadModule authn_anon_module modules/mod_authn_anon.so
#LoadModule authz_owner_module modules/mod_authz_owner.so
#LoadModule authz_dbm_module modules/mod_authz_dbm.so</html:pre></xccdf-1.2:description>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_minimize_config_files_included">
                  <xccdf-1.2:title xml:lang="en-US">Minimize Configuration Files Included</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The <html:code>Include</html:code> directive directs <html:code>httpd</html:code> to load supplementary configuration files
from a provided path. The default configuration loads all files that end in <html:code>.conf</html:code>
from the <html:code>/etc/httpd/conf.d</html:code> directory.
<html:br/><html:br/>
To restrict excess configuration, the following line should be commented out and
replaced with <html:code>Include</html:code> directives that only reference required configuration files:
<html:pre>#Include conf.d/*.conf</html:pre>
If the above change was made, ensure that the SSL encryption remains loaded by
explicitly including the corresponding configuration file:
<html:pre>Include conf.d/ssl.conf</html:pre>
If PHP is necessary, a similar alteration must be made:
<html:pre>Include conf.d/php.conf</html:pre>

Explicitly listing the configuration files to be loaded during web server start-up avoids
the possibility of unwanted or malicious configuration files to be automatically included as
part of the server's running configuration.</xccdf-1.2:description>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_optional_components">
                  <xccdf-1.2:title xml:lang="en-US">Minimize Various Optional Components</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">The following modules perform very specific tasks, sometimes providing access to
just a few additional directives. If such functionality is not required (or if you
are not using these directives), comment out the associated module:
<html:ul><html:li>External filtering (response passed through external program prior to client delivery)
<html:pre>#LoadModule ext_filter_module modules/mod_ext_filter.so</html:pre></html:li><html:li>User-specified Cache Control and Expiration
<html:pre>#LoadModule expires_module modules/mod_expires.so</html:pre></html:li><html:li>Compression Output Filter (provides content compression prior to client delivery)
<html:pre>#LoadModule deflate_module modules/mod_deflate.so</html:pre></html:li><html:li>HTTP Response/Request Header Customization
<html:pre>#LoadModule headers_module modules/mod_headers.so</html:pre></html:li><html:li>User activity monitoring via cookies
<html:pre>#LoadModule usertrack_module modules/mod_usertrack.so</html:pre></html:li><html:li>Dynamically configured mass virtual hosting
<html:pre>#LoadModule vhost_alias_module modules/mod_vhost_alias.so</html:pre></html:li></html:ul>
Minimizing the number of loadable modules available to the web server reduces risk
by limiting the capabilities allowed by the web server.</xccdf-1.2:description>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_modules_improve_security">
              <xccdf-1.2:title xml:lang="en-US">Use Appropriate Modules to Improve httpd's Security</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Among the modules available for <html:code>httpd</html:code> are several whose use may improve the
security of the web server installation. This section recommends and discusses
the deployment of security-relevant modules.</xccdf-1.2:description>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_security">
                <xccdf-1.2:title xml:lang="en-US">Deploy mod_security</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">The <html:code>security</html:code> module provides an application level firewall for <html:code>httpd</html:code>.
Following its installation with the base ruleset, specific configuration advice can be found at

    <html:a href="http://www.modsecurity.org/">http://www.modsecurity.org/</html:a> to design a policy that best matches the security needs of
the web applications. Usage of <html:code>mod_security</html:code> is highly recommended for some environments,
but it should be noted this module does not ship with Red Hat Enterprise Linux itself,
and instead is provided via Extra Packages for Enterprise Linux (EPEL).
For more information on EPEL please refer to 
    <html:a href="http://fedoraproject.org/wiki/EPEL">http://fedoraproject.org/wiki/EPEL</html:a>.</xccdf-1.2:description>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_deploy_mod_ssl">
                <xccdf-1.2:title xml:lang="en-US">Deploy mod_ssl</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Because HTTP is a plain text protocol, all traffic is susceptible to passive
monitoring. If there is a need for confidentiality, SSL should be configured
and enabled to encrypt content.
<html:br/><html:br/>
Note: <html:code>mod_nss</html:code> is a FIPS 140-2 certified alternative to <html:code>mod_ssl</html:code>.
The modules share a considerable amount of code and should be nearly identical
in functionality. If FIPS 140-2 validation is required, then <html:code>mod_nss</html:code> should
be used. If it provides some feature or its greater compatibility is required,
then <html:code>mod_ssl</html:code> should be used.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_restrict_info_leakage">
              <xccdf-1.2:title xml:lang="en-US">Restrict Web Server Information Leakage</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The <html:code>ServerTokens</html:code> and <html:code>ServerSignature</html:code> directives determine how
much information the web server discloses about the configuration of the
system.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_secure_content">
              <xccdf-1.2:title xml:lang="en-US">Configure HTTPD-Served Web Content Securely</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Running <html:code>httpd</html:code> inside a <html:code>chroot</html:code> jail is designed to isolate the
web server process to a small section of the filesystem, limiting the damage if
it is compromised. Versions of Apache greater than 2.2.10 (such as the one
included with Red Hat Enterprise Linux 7) provide the <html:code>ChrootDir</html:code> directive. To run Apache
inside a chroot jail in <html:code>/chroot/apache</html:code>, add the following line to
<html:code>/etc/httpd/conf/httpd.conf</html:code>: <html:pre>ChrootDir /chroot/apache</html:pre> This
necessitates placing all files required by <html:code>httpd</html:code> inside
<html:code>/chroot/apache</html:code> , including <html:code>httpd</html:code>'s binaries, modules,
configuration files, and served web pages. The details of this configuration
are beyond the scope of this guide. This may also require additional SELinux
configuration.</xccdf-1.2:description>
              <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_web_login_banner_text" type="string">
                <xccdf-1.2:title xml:lang="en-US">Web Login Banner Verbiage</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Enter an appropriate login banner for your organization. Please note that new lines must
be expressed by the '\n' character and special characters like parentheses and quotation marks must be escaped with '\\'.</xccdf-1.2:description>
                <xccdf-1.2:value selector="dod_banners">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dod_default">^You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dod_short">^I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="dss_odaa_default">^Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.[\s\n]+This[\s\n]+is[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+and[\s\n]+related[\s\n]+equipment[\s\n]+are[\s\n]+intended[\s\n]+for[\s\n]+the[\s\n]+communication\,[\s\n]+transmission\,[\s\n]+processing\,[\s\n]+and[\s\n]+storage[\s\n]+of[\s\n]+official[\s\n]+U\.S\.[\s\n]+Government[\s\n]+or[\s\n]+other[\s\n]+authorized[\s\n]+information[\s\n]+only\.[\s\n]+All[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times[\s\n]+to[\s\n]+ensure[\s\n]+proper[\s\n]+functioning[\s\n]+of[\s\n]+equipment[\s\n]+and[\s\n]+systems[\s\n]+including[\s\n]+security[\s\n]+devices[\s\n]+and[\s\n]+systems\,[\s\n]+to[\s\n]+prevent[\s\n]+unauthorized[\s\n]+use[\s\n]+and[\s\n]+violations[\s\n]+of[\s\n]+statutes[\s\n]+and[\s\n]+security[\s\n]+regulations\,[\s\n]+to[\s\n]+deter[\s\n]+criminal[\s\n]+activity\,[\s\n]+and[\s\n]+for[\s\n]+other[\s\n]+similar[\s\n]+purposes\.[\s\n]+Any[\s\n]+user[\s\n]+of[\s\n]+a[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+should[\s\n]+be[\s\n]+aware[\s\n]+that[\s\n]+any[\s\n]+information[\s\n]+placed[\s\n]+in[\s\n]+the[\s\n]+system[\s\n]+is[\s\n]+subject[\s\n]+to[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+not[\s\n]+subject[\s\n]+to[\s\n]+any[\s\n]+expectation[\s\n]+of[\s\n]+privacy\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+violation[\s\n]+of[\s\n]+criminal[\s\n]+statutes\,[\s\n]+this[\s\n]+evidence[\s\n]+and[\s\n]+any[\s\n]+other[\s\n]+related[\s\n]+information\,[\s\n]+including[\s\n]+identification[\s\n]+information[\s\n]+about[\s\n]+the[\s\n]+user\,[\s\n]+may[\s\n]+be[\s\n]+provided[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.[\s\n]+If[\s\n]+monitoring[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+reveals[\s\n]+violations[\s\n]+of[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+unauthorized[\s\n]+use\,[\s\n]+employees[\s\n]+who[\s\n]+violate[\s\n]+security[\s\n]+regulations[\s\n]+or[\s\n]+make[\s\n]+unauthorized[\s\n]+use[\s\n]+of[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+systems[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+appropriate[\s\n]+disciplinary[\s\n]+action\.[\s\n]+Use[\s\n]+of[\s\n]+this[\s\n]+or[\s\n]+any[\s\n]+other[\s\n]+DoD[\s\n]+interest[\s\n]+computer[\s\n]+system[\s\n]+constitutes[\s\n]+consent[\s\n]+to[\s\n]+monitoring[\s\n]+at[\s\n]+all[\s\n]+times\.$</xccdf-1.2:value>
                <xccdf-1.2:value selector="usgcb_default">^\-\-[\s\n]+WARNING[\s\n]+\-\-[\s\n]+This[\s\n]+system[\s\n]+is[\s\n]+for[\s\n]+the[\s\n]+use[\s\n]+of[\s\n]+authorized[\s\n]+users[\s\n]+only\.[\s\n]+Individuals[\s\n]+using[\s\n]+this[\s\n]+computer[\s\n]+system[\s\n]+without[\s\n]+authority[\s\n]+or[\s\n]+in[\s\n]+excess[\s\n]+of[\s\n]+their[\s\n]+authority[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+having[\s\n]+all[\s\n]+their[\s\n]+activities[\s\n]+on[\s\n]+this[\s\n]+system[\s\n]+monitored[\s\n]+and[\s\n]+recorded[\s\n]+by[\s\n]+system[\s\n]+personnel\.[\s\n]+Anyone[\s\n]+using[\s\n]+this[\s\n]+system[\s\n]+expressly[\s\n]+consents[\s\n]+to[\s\n]+such[\s\n]+monitoring[\s\n]+and[\s\n]+is[\s\n]+advised[\s\n]+that[\s\n]+if[\s\n]+such[\s\n]+monitoring[\s\n]+reveals[\s\n]+possible[\s\n]+evidence[\s\n]+of[\s\n]+criminal[\s\n]+activity[\s\n]+system[\s\n]+personal[\s\n]+may[\s\n]+provide[\s\n]+the[\s\n]+evidence[\s\n]+of[\s\n]+such[\s\n]+monitoring[\s\n]+to[\s\n]+law[\s\n]+enforcement[\s\n]+officials\.$</xccdf-1.2:value>
              </xccdf-1.2:Value>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_httpd_use_dos_protection_modules">
              <xccdf-1.2:title xml:lang="en-US">Use Denial-of-Service Protection Modules</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Denial-of-service attacks are difficult to detect and prevent while maintaining
acceptable access to authorized users. However, some traffic-shaping
modules can be used to address the problem. Well-known DoS protection modules include:
<html:pre>mod_cband mod_bwshare mod_limitipconn mod_evasive</html:pre>
Denial-of-service prevention should be implemented for a web server if such a threat exists.
However, specific configuration details are very dependent on the environment and often best left
at the discretion of the administrator.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_imap">
          <xccdf-1.2:title xml:lang="en-US">IMAP and POP3 Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Dovecot provides IMAP and POP3 services. It is not
installed by default. The project page at 
    <html:a href="http://www.dovecot.org">http://www.dovecot.org</html:a>
contains more detailed information about Dovecot
configuration.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_dovecot">
            <xccdf-1.2:title xml:lang="en-US">Configure Dovecot if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If the system will operate as an IMAP or
POP3 server, the dovecot software should be configured securely by following
the recommendations below.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_allow_imap_access">
              <xccdf-1.2:title xml:lang="en-US">Allow IMAP Clients to Access the Server</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">
The default iptables configuration does not allow inbound access to any services.
This modification will allow remote hosts to initiate connections to the IMAP daemon,
while keeping all other ports on the server in their default protected state.
To configure <html:code>iptables</html:code> to allow port 143 traffic, one must edit
<html:code>/etc/sysconfig/iptables</html:code> and
<html:code>/etc/sysconfig/ip6tables</html:code> (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
<html:pre>-A INPUT -m state --state NEW -p tcp --dport 143 -j ACCEPT</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_enabling_ssl">
              <xccdf-1.2:title xml:lang="en-US">Enable SSL Support</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">SSL should be used to encrypt network traffic between the 
Dovecot server and its clients. Users must authenticate to the Dovecot 
server in order to read their mail, and passwords should never be 
transmitted in clear text. In addition, protecting mail as it is 
downloaded is a privacy measure, and clients may use SSL certificates 
to authenticate the server, preventing another system from impersonating 
the server.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_dovecot_support_necessary_protocols">
              <xccdf-1.2:title xml:lang="en-US">Support Only the Necessary Protocols</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Dovecot supports the IMAP and POP3 protocols, as well as 
SSL-protected versions of those protocols. Configure the Dovecot server 
to support only the protocols needed by your site. Edit <html:code>/etc/dovecot/dovecot.conf</html:code>. 
Add or correct the following lines, replacing <html:code>PROTOCOL</html:code> with 
only the subset of protocols (<html:code>imap</html:code>, <html:code>imaps</html:code>, 
<html:code>pop3</html:code>, <html:code>pop3s</html:code>) required:
<html:pre>protocols = PROTOCOL</html:pre>
If possible, require SSL protection for all transactions. The SSL 
protocol variants listen on alternate ports (995 instead of 110 for 
pop3s, and 993 instead of 143 for imaps), and require SSL-aware clients. 
An alternate approach is to listen on the standard port and require the 
client to use the STARTTLS command before authenticating.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_dovecot">
            <xccdf-1.2:title xml:lang="en-US">Disable Dovecot</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If the system does not need to operate as an IMAP or
POP3 server, the dovecot software should be disabled and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_kerberos">
          <xccdf-1.2:title xml:lang="en-US">Kerberos</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Kerberos protocol is used for authentication across
non-secure network. Authentication can happen between
various types of principals -- users, service, or hosts.
Their identity and encryption keys can be stored in keytab
files.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ldap">
          <xccdf-1.2:title xml:lang="en-US">LDAP</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">LDAP is a popular directory service, that is, a
standardized way of looking up information from a central database.
Fedora includes software that enables a system to act as both
an LDAP client and server.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_openldap_client">
            <xccdf-1.2:title xml:lang="en-US">Configure OpenLDAP Clients</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This section provides information on which security settings are
important to configure in OpenLDAP clients by manually editing the appropriate
configuration files.  Fedora provides an automated configuration tool called
authconfig and a graphical wrapper for authconfig called
<html:code>system-config-authentication</html:code>. However, these tools do not provide as
much control over configuration as manual editing of configuration files. The
authconfig tools do not allow you to specify locations of SSL certificate
files, which is useful when trying to use SSL cleanly across several protocols.
Installation and configuration of OpenLDAP on Fedora is available at</xccdf-1.2:description>
            <xccdf-1.2:warning xml:lang="en-US" category="general">Before configuring any system to be an
LDAP client, ensure that a working LDAP server is present on the
network.</xccdf-1.2:warning>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_openldap_server">
            <xccdf-1.2:title xml:lang="en-US">Configure OpenLDAP Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This section details some security-relevant settings
for an OpenLDAP server.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ldap_server_config_certificate_files">
              <xccdf-1.2:title xml:lang="en-US">Install and Protect LDAP Certificate Files</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Create the PKI directory for LDAP certificates if it does not already exist:
<html:pre>$ sudo mkdir /etc/pki/tls/ldap
$ sudo chown root:root /etc/pki/tls/ldap
$ sudo chmod 755 /etc/pki/tls/ldap</html:pre>
Using removable media or some other secure transmission format, install the certificate files
onto the LDAP server:
<html:ul><html:li><html:code>/etc/pki/tls/ldap/serverkey.pem</html:code>: the private key <html:code>ldapserverkey.pem</html:code></html:li><html:li><html:code>/etc/pki/tls/ldap/servercert.pem</html:code>: the certificate file <html:code>ldapservercert.pem</html:code></html:li></html:ul>
Verify the ownership and permissions of these files:
<html:pre>$ sudo chown root:ldap /etc/pki/tls/ldap/serverkey.pem
$ sudo chown root:ldap /etc/pki/tls/ldap/servercert.pem
$ sudo chmod 640 /etc/pki/tls/ldap/serverkey.pem
$ sudo chmod 640 /etc/pki/tls/ldap/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as
<html:code>/etc/pki/tls/CA/cacert.pem</html:code>, and has the correct permissions:
<html:pre>$ sudo mkdir /etc/pki/tls/CA
$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre>

As a result of these steps, the LDAP server will have access to its own private
certificate and the key with which that certificate is encrypted, and to the
public certificate file belonging to the CA. Note that it would be possible for
the key to be protected further, so that processes running as ldap could not
read it. If this were done, the LDAP server process would need to be restarted
manually whenever the server rebooted.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mail">
          <xccdf-1.2:title xml:lang="en-US">Mail Server Software</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Mail servers are used to send and receive email over the network.
Mail is a very common service, and Mail Transfer Agents (MTAs) are obvious
targets of network attack.
Ensure that systems are not running MTAs unnecessarily,
and configure needed MTAs as defensively as possible.
<html:br/><html:br/>
Very few systems at any site should be configured to directly receive email over the
network. Users should instead use mail client programs to retrieve email
from a central server that supports protocols such as IMAP or POP3.
However, it is normal for most systems to be independently capable of sending email,
for instance so that cron jobs can report output to an administrator.
Most MTAs, including Postfix, support a submission-only mode in which mail can be sent from
the local system to a central site MTA (or directly delivered to a local account),
but the system still cannot receive mail directly over a network.
<html:br/><html:br/>
The <html:code>alternatives</html:code> program in Fedora permits selection of other mail server software
(such as Sendmail), but Postfix is the default and is preferred.
Postfix was coded with security in mind and can also be more effectively contained by
SELinux as its modular design has resulted in separate processes performing specific actions.
More information is available on its website, 
    <html:a href="http://www.postfix.org">http://www.postfix.org</html:a>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_client">
            <xccdf-1.2:title xml:lang="en-US">Configure SMTP For Mail Clients</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This section discusses settings for Postfix in a submission-only
e-mail configuration.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces" type="string">
              <xccdf-1.2:title xml:lang="en-US">Postfix Network Interfaces</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The setting for inet_interfaces in /etc/postfix/main.cf</xccdf-1.2:description>
              <xccdf-1.2:value selector="loopback-only">loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value>loopback-only</xccdf-1.2:value>
              <xccdf-1.2:value selector="localhost">localhost</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_relayhost" type="string">
              <xccdf-1.2:title xml:lang="en-US">Postfix relayhost</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the host all outbound email should be routed into.</xccdf-1.2:description>
              <xccdf-1.2:value>smtp.$mydomain</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">Postfix Root Mail Alias</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify an email address (string) for a root mail alias.</xccdf-1.2:description>
              <xccdf-1.2:value>system.administrator@mail.mil</xccdf-1.2:value>
            </xccdf-1.2:Value>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_harden_os">
            <xccdf-1.2:title xml:lang="en-US">Configure Operating System to Protect Mail Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The guidance in this section is appropriate for any host which is
operating as a site MTA, whether the mail server runs using Sendmail, Postfix,
or some other software.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:postfix"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_configure_ssl_certs">
              <xccdf-1.2:title xml:lang="en-US">Configure SSL Certificates for Use with SMTP AUTH</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If SMTP AUTH is to be used, the use of SSL to protect credentials in transit is strongly recommended.
There are also configurations for which it may be desirable to encrypt all mail in transit from one MTA to another,
though such configurations are beyond the scope of this guide. In either event, the steps for creating and installing
an SSL certificate are independent of the MTA in use, and are described here.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:postfix"/>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_install_ssl_cert">
                <xccdf-1.2:title xml:lang="en-US">Ensure Security of Postfix SSL Certificate</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Create the PKI directory for mail certificates, if it does not already exist:
<html:pre>$ sudo mkdir /etc/pki/tls/mail
$ sudo chown root:root /etc/pki/tls/mail
$ sudo chmod 755 /etc/pki/tls/mail</html:pre>
Using removable media or some other secure transmission format, install the files generated in the previous
step onto the mail server:
<html:pre>/etc/pki/tls/mail/serverkey.pem: the private key mailserverkey.pem
/etc/pki/tls/mail/servercert.pem: the certificate file mailservercert.pem</html:pre>
Verify the ownership and permissions of these files:
<html:pre>$ sudo chown root:root /etc/pki/tls/mail/serverkey.pem
$ sudo chown root:root /etc/pki/tls/mail/servercert.pem
$ sudo chmod 600 /etc/pki/tls/mail/serverkey.pem
$ sudo chmod 644 /etc/pki/tls/mail/servercert.pem</html:pre>
Verify that the CA's public certificate file has been installed as <html:code>/etc/pki/tls/CA/cacert.pem</html:code>, and has the
correct permissions:
<html:pre>$ sudo chown root:root /etc/pki/tls/CA/cacert.pem
$ sudo chmod 644 /etc/pki/tls/CA/cacert.pem</html:pre></xccdf-1.2:description>
                <xccdf-1.2:platform idref="cpe:/a:postfix"/>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_cfg">
              <xccdf-1.2:title xml:lang="en-US">Configure Postfix if Necessary</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Postfix stores its configuration files in the directory
/etc/postfix by default. The primary configuration file is
<html:code>/etc/postfix/main.cf</html:code>.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:postfix"/>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_dos">
                <xccdf-1.2:title xml:lang="en-US">Configure Postfix Resource Usage to Limit Denial of Service Attacks</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Edit <html:code>/etc/postfix/main.cf</html:code>. Edit the following lines to
configure the amount of system resources Postfix can consume:
<html:pre>default_process_limit = 100
smtpd_client_connection_count_limit = 10
smtpd_client_connection_rate_limit = 30
queue_minfree = 20971520
header_size_limit = 51200
message_size_limit = 10485760
smtpd_recipient_limit = 100</html:pre>
The values here are examples.</xccdf-1.2:description>
                <xccdf-1.2:warning xml:lang="en-US" category="general">Note: The values given here are examples, and may
need to be modified for any particular site. By default, the Postfix anvil
process gathers mail receipt statistics. To get information about about what
connection rates are typical at your site, look in <html:code>/var/log/maillog</html:code>
for lines with the daemon name postfix/anvil.</xccdf-1.2:warning>
                <xccdf-1.2:platform idref="cpe:/a:postfix"/>
              </xccdf-1.2:Group>
              <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay">
                <xccdf-1.2:title xml:lang="en-US">Control Mail Relaying</xccdf-1.2:title>
                <xccdf-1.2:description xml:lang="en-US">Postfix's mail relay controls are implemented with the help of the
smtpd recipient restrictions option, which controls the restrictions placed on
the SMTP dialogue once the sender and recipient envelope addresses are known.
The guidance in the following sections should be applied to all systems. If
there are systems which must be allowed to relay mail, but which cannot be
trusted to relay unconditionally, configure SMTP AUTH with SSL support.</xccdf-1.2:description>
                <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_recipient_restrictions">
                  <xccdf-1.2:title xml:lang="en-US">Enact SMTP Recipient Restrictions</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br/>
The full contents of <html:code>smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code>permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code>mynetworks</html:code>. Then, the
<html:code>reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_mail_smtpd_relay_restrictions">
                  <xccdf-1.2:title xml:lang="en-US">Enact SMTP Relay Restrictions</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">To configure Postfix to restrict addresses to which it
will send mail, see:

    <html:a href="http://www.postfix.org/SMTPD_ACCESS_README.html#danger">http://www.postfix.org/SMTPD_ACCESS_README.html#danger</html:a>
<html:br/>
The full contents of <html:code>smtpd_recipient_restrictions</html:code> will
vary by site, since this is a common place to put spam restrictions and other
site-specific options. The <html:code>permit_mynetworks</html:code> option allows all mail to
be relayed from the systems in <html:code>mynetworks</html:code>. Then, the
<html:code>reject_unauth_destination</html:code> option denies all mail whose destination
address is not local, preventing any other systems from relaying. These two
options should always appear in this order, and should usually follow one
another immediately unless SMTP AUTH is used.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_require_tls">
                  <xccdf-1.2:title xml:lang="en-US">Use TLS for SMTP AUTH</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Postfix provides options to use TLS for certificate-based
authentication and encrypted sessions. An encrypted session protects the
information that is transmitted with SMTP mail or with SASL authentication.
To configure Postfix to protect all SMTP AUTH transactions
using TLS, see 
    <html:a href="http://www.postfix.org/TLS_README.html">http://www.postfix.org/TLS_README.html</html:a>.</xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_set_trusted">
                  <xccdf-1.2:title xml:lang="en-US">Configure Trusted Networks and Hosts</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">Edit <html:code>/etc/postfix/main.cf</html:code>, and configure the contents of
the <html:code>mynetworks</html:code> variable in one of the following ways:
<html:ul><html:li>If any system in the subnet containing the MTA may be trusted to relay
messages, add or correct the following line:
<html:pre>mynetworks_style = subnet</html:pre>
This is also the default setting, and is in effect if all
<html:code>my_networks_style</html:code> directives are commented.</html:li><html:li>If only the MTA host itself is trusted to relay messages, add or correct
the following line:
<html:pre>mynetworks_style = host</html:pre></html:li><html:li>If the set of systems which can relay is more complicated, manually
specify an entry for each netblock or IP address which is trusted to relay by
setting the <html:code>mynetworks</html:code> variable directly:
<html:pre>mynetworks = 10.0.0.0/16, 192.168.1.0/24, 127.0.0.1</html:pre></html:li></html:ul></xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                </xccdf-1.2:Group>
                <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_postfix_server_relay_smtp_auth_for_untrusted">
                  <xccdf-1.2:title xml:lang="en-US">Require SMTP AUTH Before Relaying from Untrusted Clients</xccdf-1.2:title>
                  <xccdf-1.2:description xml:lang="en-US">SMTP authentication allows remote clients to relay mail safely by
requiring them to authenticate before submitting mail. Postfix's SMTP AUTH uses
an authentication library called SASL, which is not part of Postfix itself.  To
enable the use of SASL authentication, see

    <html:a href="http://www.postfix.org/SASL_README.html">http://www.postfix.org/SASL_README.html</html:a></xccdf-1.2:description>
                  <xccdf-1.2:platform idref="cpe:/a:postfix"/>
                </xccdf-1.2:Group>
              </xccdf-1.2:Group>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_and_rpc">
          <xccdf-1.2:title xml:lang="en-US">NFS and RPC</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Network File System is a popular distributed filesystem for
the Unix environment, and is very widely deployed.  This section discusses the
circumstances under which it is possible to disable NFS and its dependencies,
and then details steps which should be taken to secure
NFS's configuration. This section is relevant to systems operating as NFS
clients, as well as to those operating as NFS servers.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfs">
            <xccdf-1.2:title xml:lang="en-US">Disable All NFS Services if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If there is not a reason for the system to operate as either an
NFS client or an NFS server, follow all instructions in this section to disable
subsystems required by NFS.</xccdf-1.2:description>
            <xccdf-1.2:warning xml:lang="en-US" category="general">The steps in this section will prevent a system
from operating as either an NFS client or an NFS server. Only perform these
steps on systems which do not need NFS at all.</xccdf-1.2:warning>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_netfs">
              <xccdf-1.2:title xml:lang="en-US">Disable netfs if Possible</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">To determine if any network filesystems handled by netfs are
currently mounted on the system execute the following command:
<html:pre>$ mount -t nfs,nfs4,smbfs,cifs,ncpfs</html:pre>
If the command did not return any output then disable netfs.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfs_services">
              <xccdf-1.2:title xml:lang="en-US">Disable Services Used Only by NFS</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If NFS is not needed, disable the NFS client daemons nfslock, rpcgssd, and rpcidmapd.
<html:br/><html:br/>
All of these daemons run with elevated privileges, and many listen for network
connections. If they are not needed, they should be disabled to improve system
security posture.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_all_machines">
            <xccdf-1.2:title xml:lang="en-US">Configure All Systems which Use NFS</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The steps in this section are appropriate for all systems which
run NFS, whether they operate as clients or as servers.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_client_or_server_not_both">
              <xccdf-1.2:title xml:lang="en-US">Make Each System a Client or a Server, not Both</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If NFS must be used, it should be deployed in the simplest
configuration possible to avoid maintainability problems which may lead to
unnecessary security exposure. Due to the reliability and security problems
caused by NFS (specially NFSv3 and NFSv2), it is not a good idea for systems
which act as NFS servers to also mount filesystems via NFS. At the least,
crossed mounts (the situation in which each of two servers mounts a filesystem
from the other) should never be used.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configure_fixed_ports">
              <xccdf-1.2:title xml:lang="en-US">Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Firewalling should be done at each host and at the border
firewalls to protect the NFS daemons from remote access, since NFS servers
should never be accessible from outside the organization. However, by default
for NFSv3 and NFSv2, the RPC Bind service assigns each NFS service to a port
dynamically at service startup time. Dynamic ports cannot be protected by port

filtering firewalls such as <html:code>iptables</html:code>.

<html:br/><html:br/>
Therefore, restrict each service to always use a given port, so that
firewalling can be done effectively. Note that, because of the way RPC is
implemented, it is not possible to disable the RPC Bind service even if ports
are assigned statically to all RPC services.
<html:br/><html:br/>
In NFSv4, the mounting and locking protocols have been incorporated into the
protocol, and the server listens on the the well-known TCP port 2049. As such,
NFSv4 does not need to interact with the <html:code>rpcbind, lockd, and rpc.statd</html:code>
daemons, which can and should be disabled in a pure NFSv4 environment. The
<html:code>rpc.mountd</html:code> daemon is still required on the NFS server to setup
exports, but is not involved in any over-the-wire operations.</xccdf-1.2:description>
              </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_clients">
            <xccdf-1.2:title xml:lang="en-US">Configure NFS Clients</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The steps in this section are appropriate for systems which operate as NFS clients.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_nfsd">
              <xccdf-1.2:title xml:lang="en-US">Disable NFS Server Daemons</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">There is no need to run the NFS server daemons <html:code>nfs</html:code> and
<html:code>rpcsvcgssd</html:code> except on a small number of properly secured systems
designated as NFS servers. Ensure that these daemons are turned off on
clients.</xccdf-1.2:description>
              </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_mounting_remote_filesystems">
              <xccdf-1.2:title xml:lang="en-US">Mount Remote Filesystems with Restrictive Options</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Edit the file <html:code>/etc/fstab</html:code>. For each filesystem whose type
(column 3) is <html:code>nfs</html:code> or <html:code>nfs4</html:code>, add the text
<html:code>,nodev,nosuid</html:code> to the list of mount options in column 4. If
appropriate, also add <html:code>,noexec</html:code>.
<html:br/><html:br/>
See the section titled "Restrict Partition Mount Options" for a description of
the effects of these options. In general, execution of files mounted via NFS
should be considered risky because of the possibility that an adversary could
intercept the request and substitute a malicious file. Allowing setuid files to
be executed from remote servers is particularly risky, both for this reason and
because it requires the clients to extend root-level trust to the NFS
server.</xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nfs_configuring_servers">
            <xccdf-1.2:title xml:lang="en-US">Configure NFS Servers</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The steps in this section are appropriate for systems which operate as NFS servers.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_exports_restrictively">
              <xccdf-1.2:title xml:lang="en-US">Configure the Exports File Restrictively</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Linux's NFS implementation uses the file <html:code>/etc/exports</html:code> to control what filesystems
and directories may be accessed via NFS. (See the <html:code>exports(5)</html:code> manpage for more information about the
format of this file.)
<html:br/><html:br/>
The syntax of the <html:code>exports</html:code> file is not necessarily checked fully on reload, and syntax errors
can leave your NFS configuration more open than intended. Therefore, exercise caution when modifying
the file.
<html:br/><html:br/>
The syntax of each line in <html:code>/etc/exports</html:code> is:
<html:pre>/DIR	host1(opt1,opt2) host2(opt3)</html:pre>
where <html:code>/DIR</html:code> is a directory or filesystem to export, <html:code>hostN</html:code> is an IP address, netblock,
hostname, domain, or netgroup to which to export, and <html:code>optN</html:code> is an option.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_export_filesystems_read_only">
              <xccdf-1.2:title xml:lang="en-US">Export Filesystems Read-Only if Possible</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If a filesystem is being exported so that users can view the files in a convenient
fashion, but there is no need for users to edit those files, exporting the filesystem read-only
removes an attack vector against the server. The default filesystem export mode is <html:code>ro</html:code>,
so do not specify <html:code>rw</html:code> without a good reason.</xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_use_acl_enforce_auth_restrictions">
              <xccdf-1.2:title xml:lang="en-US">Use Access Lists to Enforce Authorization Restrictions</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">When configuring NFS exports, ensure that each export line in <html:code>/etc/exports</html:code> contains
a list of hosts which are allowed to access that export. If no hosts are specified on an export line,
then that export is available to any remote host which requests it. All lines of the exports file should
specify the hosts (or subnets, if needed) which are allowed to access the exported directory, so that
unknown or remote hosts will be denied.
<html:br/><html:br/>
Authorized hosts can be specified in several different formats:
<html:ul><html:li>Name or alias that is recognized by the resolver</html:li><html:li>Fully qualified domain name</html:li><html:li>IP address</html:li><html:li>IP subnets in the format <html:code>address/netmask</html:code> or <html:code>address/CIDR</html:code></html:li></html:ul></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ntp">
          <xccdf-1.2:title xml:lang="en-US">Network Time Protocol</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Network Time Protocol is used to manage the system
clock over a network. Computer clocks are not very accurate, so
time will drift unpredictably on unmanaged systems. Central time
protocols can be used both to ensure that time is consistent among
a network of systems, and that their time is consistent with the
outside world.
<html:br/><html:br/>
If every system on a network reliably reports the same time, then it is much
easier to correlate log messages in case of an attack. In addition, a number of
cryptographic protocols (such as Kerberos) use timestamps to prevent certain
types of attacks. If your network does not have synchronized time, these
protocols may be unreliable or even unusable.
<html:br/><html:br/>
Depending on the specifics of the network, global time accuracy may be just as
important as local synchronization, or not very important at all. If your
network is connected to the Internet, using a public timeserver (or one
provided by your enterprise) provides globally accurate timestamps which may be
essential in investigating or responding to an attack which originated outside
of your network.
<html:br/><html:br/>
A typical network setup involves a small number of internal systems operating
as NTP servers, and the remainder obtaining time information from those
internal servers.
<html:br/><html:br/>
There is a choice between the daemons <html:code>ntpd</html:code> and <html:code>chronyd</html:code>, which
are available from the repositories in the <html:code>ntp</html:code> and <html:code>chrony</html:code>
packages respectively.
<html:br/><html:br/>
The default <html:code>chronyd</html:code> daemon can work well when external time references
are only intermittently accesible, can perform well even when the network is
congested for longer periods of time, can usually synchronize the clock faster
and with better time accuracy, and quickly adapts to sudden changes in the rate
of the clock, for example, due to changes in the temperature of the crystal
oscillator. <html:code>Chronyd</html:code> should be considered for all systems which are
frequently suspended or otherwise intermittently disconnected and reconnected
to a network. Mobile and virtual systems for example.
<html:br/><html:br/>
The <html:code>ntpd</html:code> NTP daemon fully supports NTP protocol version 4 (RFC 5905),
including broadcast, multicast, manycast clients and servers, and the orphan
mode. It also supports extra authentication schemes based on public-key
cryptography (RFC 5906). The NTP daemon (<html:code>ntpd</html:code>) should be considered
for systems which are normally kept permanently on. Systems which are required
to use broadcast or multicast IP, or to perform authentication of packets with
the <html:code>Autokey</html:code> protocol, should consider using <html:code>ntpd</html:code>.
<html:br/><html:br/>
Refer to

    
    <html:a href="https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/">https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/</html:a>

for more detailed comparison of features of <html:code>chronyd</html:code>
and <html:code>ntpd</html:code> daemon features respectively, and for further guidance how to
choose between the two NTP daemons.
<html:br/><html:br/>
The upstream manual pages at 
    <html:a href="http://chrony.tuxfamily.org/manual.html">http://chrony.tuxfamily.org/manual.html</html:a> for
<html:code>chronyd</html:code> and 
    <html:a href="http://www.ntp.org">http://www.ntp.org</html:a> for <html:code>ntpd</html:code> provide additional
information on the capabilities and configuration of each of the NTP daemons.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_multiple_time_servers" type="string" interactive="true">
            <xccdf-1.2:title xml:lang="en-US">Vendor Approved Time Servers</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The list of vendor-approved time servers</xccdf-1.2:description>
            <xccdf-1.2:value>0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="fedora">0.fedora.pool.ntp.org,1.fedora.pool.ntp.org,2.fedora.pool.ntp.org,3.fedora.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="rhel">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="ol">0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org</xccdf-1.2:value>
            <xccdf-1.2:value selector="suse">0.suse.pool.ntp.org,1.suse.pool.ntp.org,2.suse.pool.ntp.org,3.suse.pool.ntp.org</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll" type="number">
            <xccdf-1.2:title xml:lang="en-US">Maximum NTP or Chrony Poll</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The maximum NTP or Chrony poll interval number in seconds specified as a power of two.</xccdf-1.2:description>
            <xccdf-1.2:value selector="36_hours">17</xccdf-1.2:value>
            <xccdf-1.2:value selector="18_hours">16</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
            <xccdf-1.2:value selector="system_default">10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Enable the NTP Daemon</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">

Run the following command to determine the current status of the
<html:code>chronyd</html:code> service:
<html:pre>$ systemctl is-active chronyd</html:pre>
If the service is running, it should return the following: <html:pre>active</html:pre>
Note: The <html:code>chronyd</html:code> daemon is enabled by default.
<html:br/><html:br/>


Run the following command to determine the current status of the
<html:code>ntpd</html:code> service:
<html:pre>$ systemctl is-active ntpd</html:pre>
If the service is running, it should return the following: <html:pre>active</html:pre>
Note: The <html:code>ntpd</html:code> daemon is not enabled by default. Though as mentioned
in the previous sections in certain environments the <html:code>ntpd</html:code> daemon might
be preferred to be used rather than the <html:code>chronyd</html:code> one. Refer to:

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for guidance which NTP daemon to choose depending on the environment used.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000356-VMM-001340</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US">Enabling some of <html:code>chronyd</html:code> or <html:code>ntpd</html:code> services ensures
that the NTP daemon will be running and that the system will synchronize its
time to any servers specified. This is important whether the system is
configured to be a client (and synchronize only its own clock) or it is also
acting as an NTP server to other systems.  Synchronizing time is essential for
authentication services such as Kerberos, but it is also important for
maintaining accurate logs and auditing possible security breaches.
<html:br/><html:br/>
The <html:code>chronyd</html:code> and <html:code>ntpd</html:code> NTP daemons offer all of the
functionality of <html:code>ntpdate</html:code>, which is now deprecated.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:fix id="service_chronyd_or_ntpd_enabled" system="urn:xccdf:fix:script:sh" complexity="low" disruption="low" strategy="enable"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then

if rpm --quiet -q "chrony" ; then
    if ! /usr/sbin/pidof ntpd ; then
        /usr/bin/systemctl enable "chronyd"
        /usr/bin/systemctl start "chronyd"
        # The service may not be running because it has been started and failed,
        # so let's reset the state so OVAL checks pass.
        # Service should be 'inactive', not 'failed' after reboot though.
        /usr/bin/systemctl reset-failed "chronyd"
    fi
elif rpm --quiet -q "ntp" ; then
    /usr/bin/systemctl enable "ntpd"
    /usr/bin/systemctl start "ntpd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "ntpd"
else
    if ! rpm -q --quiet "chrony" ; then
        dnf install -y "chrony"
    fi
    /usr/bin/systemctl enable "chronyd"
    /usr/bin/systemctl start "chronyd"
    # The service may not be running because it has been started and failed,
    # so let's reset the state so OVAL checks pass.
    # Service should be 'inactive', not 'failed' after reboot though.
    /usr/bin/systemctl reset-failed "chronyd"
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="service_chronyd_or_ntpd_enabled" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="enable">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Gather the package facts
  ansible.builtin.package_facts:
    manager: auto
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Start ntpd service if ntp installed
  service:
    name: ntpd
    enabled: 'yes'
    state: started
    masked: 'no'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - '''ntp'' in ansible_facts.packages'
  ignore_errors: true
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled

- name: Start chronyd service if chrony or chronyd installed
  service:
    name: chronyd
    enabled: 'yes'
    state: started
    masked: 'no'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ('chrony' in ansible_facts.packages) or ('chronyd' in ansible_facts.packages)
  ignore_errors: true
  tags:
    - NIST-800-171-3.3.7
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4
    - enable_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - service_chronyd_or_ntpd_enabled
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref name="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Specify Additional Remote NTP Servers</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code>chronyd</html:code> NTP daemon (the
default), or services of the <html:code>ntpd</html:code> NTP daemon. Refer to

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br/>
Additional NTP servers can be specified for time synchronization. To do so,
perform the following:
<html:ul><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon
(the default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add additional lines of the following form, substituting the IP address or
hostname of a remote NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0988</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1405</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US">Specifying additional NTP servers increases the availability of
accurate time data, in the event that one of the specified servers becomes
unavailable. This is typical for a system acting as an NTP server for
other systems.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:fix id="chronyd_or_ntpd_specify_multiple_servers" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_multiple_time_servers="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>"



config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! [ "$(grep -c '^server' "$config_file")" -gt 1 ] ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="chronyd_or_ntpd_specify_multiple_servers" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="configure">- name: XCCDF Value var_multiple_time_servers # promote to variable
  set_fact:
    var_multiple_time_servers: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>
  tags:
    - always

- name: Detect if chrony configuration file is present
  find:
    path: /etc
    patterns: chrony.conf
  register: chrony_server_config
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure multiple time servers in chrony config
  lineinfile:
    path: /etc/chrony.conf
    line: server {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - chrony_server_config.matched == 1
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Detect if NTP configuration file is present
  find:
    path: /etc
    patterns: ntp.conf
  register: ntp_server_config
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed

- name: Configure multiple time servers in NTP config
  lineinfile:
    path: /etc/chrony.conf
    line: pool {{ item }}
    state: present
    create: true
  loop: '{{ var_multiple_time_servers.split(",") }}'
  when:
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - ntp_server_config.matched == 1
  tags:
    - NIST-800-53-AU-8(1)(a)
    - NIST-800-53-AU-8(2)
    - NIST-800-53-CM-6(a)
    - PCI-DSS-Req-10.4.3
    - chronyd_or_ntpd_specify_multiple_servers
    - configure_strategy
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="chronyd_or_ntpd_specify_multiple_servers" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Specify a Remote NTP Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Depending on specific functional requirements of a concrete
production environment, the Fedora system can be
configured to utilize the services of the <html:code>chronyd</html:code> NTP daemon (the
default), or services of the <html:code>ntpd</html:code> NTP daemon. Refer to

    
    <html:a href="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite">https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-configuring_ntp_using_the_chrony_suite</html:a>

for more detailed comparison of the features of both of the choices, and for
further guidance how to choose between the two NTP daemons.
<html:br/>
To specify a remote NTP server for time synchronization, perform the following:
<html:ul><html:li> if the system is configured to use the <html:code>chronyd</html:code> as the NTP daemon (the
default), edit the file <html:code>/etc/chrony.conf</html:code> as follows,</html:li><html:li> if the system is configured to use the <html:code>ntpd</html:code> as the NTP daemon,
edit the file <html:code>/etc/ntp.conf</html:code> as documented below.</html:li></html:ul>
Add or correct the following lines, substituting the IP or hostname of a remote
NTP server for <html:em>ntpserver</html:em>:
<html:pre>server <html:i>ntpserver</html:i></html:pre>
This instructs the NTP software to contact that remote server to obtain time
data.</xccdf-1.2:description>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">6</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO11.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.05</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">MEA02.01</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.3.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001891</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.3.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.4.7</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.4.2.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.10</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.11</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.12</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.8</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.9</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.2</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.4</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.7.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(1)(a)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AU-8(2)</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.PT-1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.1</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-10.4.3</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000355-VMM-001330</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US">Synchronizing with an NTP server makes it possible to collate system
logs from multiple sources or correlate computer events with real time events.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:fix id="chronyd_or_ntpd_specify_remote_server" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_multiple_time_servers="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers" use="legacy"/>"



config_file="/etc/ntp.conf"
/usr/sbin/pidof ntpd || config_file="/etc/chrony.conf"

if ! grep -q ^server "$config_file" ; then
  if ! grep -q '#[[:space:]]*server' "$config_file" ; then
    for server in $(echo "$var_multiple_time_servers" | tr ',' '\n') ; do
      printf '\nserver %s' "$server" &gt;&gt; "$config_file"
    done
  else
    sed -i 's/#[ \t]*server/server/g' "$config_file"
  fi
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="chronyd_or_ntpd_specify_remote_server" system="urn:xccdf:fix:script:kubernetes" reboot="true" complexity="low" disruption="low" strategy="restrict">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    storage:
      files:
      - contents:
          source: data:,%23%20Allow%20for%20extra%20configuration%20files.%20This%20is%20useful%0A%23%20for%20admins%20specifying%20their%20own%20NTP%20servers%0Ainclude%20/etc/chrony.d/%2A.conf%0A%0A%23%20Set%20chronyd%20as%20client-only.%0Aport%200%0A%0A%23%20Disable%20chronyc%20from%20the%20network%0Acmdport%200%0A%0A%23%20Record%20the%20rate%20at%20which%20the%20system%20clock%20gains/losses%20time.%0Adriftfile%20/var/lib/chrony/drift%0A%0A%23%20Allow%20the%20system%20clock%20to%20be%20stepped%20in%20the%20first%20three%20updates%0A%23%20if%20its%20offset%20is%20larger%20than%201%20second.%0Amakestep%201.0%203%0A%0A%23%20Enable%20kernel%20synchronization%20of%20the%20real-time%20clock%20%28RTC%29.%0Artcsync%0A%0A%23%20Enable%20hardware%20timestamping%20on%20all%20interfaces%20that%20support%20it.%0A%23hwtimestamp%20%2A%0A%0A%23%20Increase%20the%20minimum%20number%20of%20selectable%20sources%20required%20to%20adjust%0A%23%20the%20system%20clock.%0A%23minsources%202%0A%0A%23%20Allow%20NTP%20client%20access%20from%20local%20network.%0A%23allow%20192.168.0.0/16%0A%0A%23%20Serve%20time%20even%20if%20not%20synchronized%20to%20a%20time%20source.%0A%23local%20stratum%2010%0A%0A%23%20Require%20authentication%20%28nts%20or%20key%20option%29%20for%20all%20NTP%20sources.%0A%23authselectmode%20require%0A%0A%23%20Specify%20file%20containing%20keys%20for%20NTP%20authentication.%0Akeyfile%20/etc/chrony.keys%0A%0A%23%20Insert/delete%20leap%20seconds%20by%20slewing%20instead%20of%20stepping.%0A%23leapsecmode%20slew%0A%0A%23%20Get%20TAI-UTC%20offset%20and%20leap%20seconds%20from%20the%20system%20tz%20database.%0Aleapsectz%20right/UTC%0A%0A%23%20Specify%20directory%20for%20log%20files.%0Alogdir%20/var/log/chrony%0A%0A%23%20Select%20which%20information%20is%20logged.%0A%23log%20measurements%20statistics%20tracking
        mode: 420
        overwrite: true
        path: /etc/chrony.conf
      - contents:
          source: data:,
        mode: 420
        overwrite: true
        path: /etc/chrony.d/.mco-keep
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref name="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_obsolete">
          <xccdf-1.2:title xml:lang="en-US">Obsolete Services</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">This section discusses a number of network-visible
services which have historically caused problems for system
security, and for which disabling or severely limiting the service
has been the best available guidance for some time. As a result of
this, many of these services are not installed as part of Fedora
by default.
<html:br/><html:br/>
Organizations which are running these services should
switch to more secure equivalents as soon as possible.
If it remains absolutely necessary to run one of
these services for legacy reasons, care should be taken to restrict
the service as much as possible, for instance by configuring host

firewall software such as <html:code>iptables</html:code> to restrict access to the

vulnerable service to only those remote hosts which have a known
need to use it.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_inetd_and_xinetd">
            <xccdf-1.2:title xml:lang="en-US">Xinetd</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The <html:code>xinetd</html:code> service acts as a dedicated listener for some
network services (mostly, obsolete ones) and can be used to provide access
controls and perform some logging. It has been largely obsoleted by other
features, and it is not installed by default. The older Inetd service
is not even available as part of Fedora.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_nis">
            <xccdf-1.2:title xml:lang="en-US">NIS</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The Network Information Service (NIS), also known as 'Yellow
Pages' (YP), and its successor NIS+ have been made obsolete by
Kerberos, LDAP, and other modern centralized authentication
services. NIS should not be used because it suffers from security
problems inherent in its design, such as inadequate protection of
important authentication information.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_r_services">
            <xccdf-1.2:title xml:lang="en-US">Rlogin, Rsh, and Rexec</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The Berkeley r-commands are legacy services which
allow cleartext remote access and have an insecure trust
model.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_talk">
            <xccdf-1.2:title xml:lang="en-US">Chat/Messaging Services</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The talk software makes it possible for users to send and receive messages
across systems through a terminal session.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_telnet">
            <xccdf-1.2:title xml:lang="en-US">Telnet</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The telnet protocol does not provide confidentiality or integrity
for information transmitted on the network. This includes authentication
information such as passwords. Organizations which use telnet should be
actively working to migrate to a more secure protocol.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_tftp">
            <xccdf-1.2:title xml:lang="en-US">TFTP Server</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">TFTP is a lightweight version of the FTP protocol which has
traditionally been used to configure networking equipment. However,
TFTP provides little security, and modern versions of networking
operating systems frequently support configuration via SSH or other
more secure protocols. A TFTP server should be run only if no more
secure method of supporting existing equipment can be
found.</xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">TFTP server secure directory</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the directory which is used by TFTP server as a root directory when running in secure mode.</xccdf-1.2:description>
              <xccdf-1.2:value>/var/lib/tftpboot</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_printing">
          <xccdf-1.2:title xml:lang="en-US">Print Support</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Common Unix Printing System (CUPS) service provides both local
and network printing support. A system running the CUPS service can accept
print jobs from other systems, process them, and send them to the appropriate
printer. It also provides an interface for remote administration through a web
browser. The CUPS service is installed and activated by default. The project
homepage and more detailed documentation are available at

    <html:a href="http://www.cups.org">http://www.cups.org</html:a>.
<html:br/><html:br/></xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configure_printing">
            <xccdf-1.2:title xml:lang="en-US">Configure the CUPS Service if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">CUPS provides the ability to easily share local printers with
other systems over the network. It does this by allowing systems to share
lists of available printers. Additionally, each system that runs the CUPS
service can potentially act as a print server. Whenever possible, the printer
sharing and print server capabilities of CUPS should be limited or disabled.
The following recommendations should demonstrate how to do just that.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_proxy">
          <xccdf-1.2:title xml:lang="en-US">Proxy Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">A proxy server is a very desirable target for a
potential adversary because much (or all) sensitive data for a
given infrastructure may flow through it. Therefore, if one is
required, the system acting as a proxy server should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default proxy server software is Squid, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_squid">
            <xccdf-1.2:title xml:lang="en-US">Disable Squid if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If Squid was installed and activated, but the system
does not need to act as a proxy server, then it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_radius">
          <xccdf-1.2:title xml:lang="en-US">Remote Authentication Dial-In User Service (RADIUS)</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Remote Authentication Dial-In User Service (RADIUS) is a networking
protocol, operating on port 1812 that provides centralized
Authentication, Authorization, and Accounting (AAA or Triple A)
management for users who connect and use a network service. </xccdf-1.2:description>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_rng">
          <xccdf-1.2:title xml:lang="en-US">Hardware RNG Entropy Gatherer Daemon</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The rngd feeds random data from hardware device to kernel random device.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_routing">
          <xccdf-1.2:title xml:lang="en-US">Network Routing</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">A router is a very desirable target for a
potential adversary because they fulfill a variety of 
infrastructure networking roles such as access to network segments,
gateways to other networks, filtering, etc. Therefore, if one is
required, the system acting as a router should be dedicated
to that purpose alone and be stored in a physically secure
location. The system's default routing software is Quagga, and
provided in an RPM package of the same name.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_quagga">
            <xccdf-1.2:title xml:lang="en-US">Disable Quagga if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If Quagga was installed and activated, but the system
does not need to act as a router, then it should be disabled
and removed.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb">
          <xccdf-1.2:title xml:lang="en-US">Samba(SMB) Microsoft Windows File Sharing Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">When properly configured, the Samba service allows
Linux systems to provide file and print sharing to Microsoft
Windows systems. There are two software packages that provide
Samba support. The first, <html:code>samba-client</html:code>, provides a series of
command line tools that enable a client system to access Samba
shares. The second, simply labeled <html:code>samba</html:code>, provides the Samba
service. It is this second package that allows a Linux system to
act as an Active Directory server, a domain controller, or as a
domain member. Only the <html:code>samba-client</html:code> package is installed by
default.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_configuring_samba">
            <xccdf-1.2:title xml:lang="en-US">Configure Samba if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">All settings for the Samba daemon can be found in
<html:code>/etc/samba/smb.conf</html:code>. Settings are divided between a
<html:code>[global]</html:code> configuration section and a series of user
created share definition sections meant to describe file or print
shares on the system. By default, Samba will operate in user mode
and allow client systems to access local home directories and
printers. It is recommended that these settings be changed or that
additional limitations be set in place.</xccdf-1.2:description>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb_disable_printing">
              <xccdf-1.2:title xml:lang="en-US">Restrict Printer Sharing</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">By default, Samba utilizes the CUPS printing service to enable
printer sharing with Microsoft Windows workstations. If there are no printers
on the local system, or if printer sharing with Microsoft Windows is not
required, disable the printer sharing capability by commenting out the
following lines, found in <html:code>/etc/samba/smb.conf</html:code>:
<html:pre>[global]
  load printers = yes
  cups options = raw
[printers]
  comment = All Printers
  path = /usr/spool/samba
  browseable = no
  guest ok = no
  writable = no
  printable = yes</html:pre>
There may be other options present, but these are the only options enabled and
uncommented by default. Removing the <html:code>[printers]</html:code> share should be enough
for most users.  If the Samba printer sharing capability is needed, consider
disabling the Samba network browsing capability or restricting access to a
particular set of users or network addresses. Set the <html:code>valid users</html:code>
parameter to a small subset of users or restrict it to a particular group of
users with the shorthand <html:code>@</html:code>. Separate each user or group of users with
a space. For example, under the <html:code>[printers]</html:code> share:
<html:pre>[printers]
  valid users = user @printerusers</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_smb_restrict_file_sharing">
              <xccdf-1.2:title xml:lang="en-US">Restrict SMB File Sharing to Configured Networks</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Only users with local user accounts will be able to log in to
Samba shares by default. Shares can be limited to particular users or network
addresses. Use the <html:code>hosts allow</html:code> and <html:code>hosts deny</html:code> directives
accordingly, and consider setting the valid users directive to a limited subset
of users or to a group of users. Separate each address, user, or user group
with a space as follows for a particular <html:i>share</html:i> or global:
<html:pre>[<html:i>share</html:i>]
  hosts allow = 192.168.1. 127.0.0.1
  valid users = userone usertwo @usergroup</html:pre>
It is also possible to limit read and write access to particular users with the
read list and write list options, though the permissions set by the system
itself will override these settings. Set the read only attribute for each share
to ensure that global settings will not accidentally override the individual
share settings. Then, as with the valid users directive, separate each user or
group of users with a space:
<html:pre>[<html:i>share</html:i>]
  read only = yes
  write list = userone usertwo @usergroup</html:pre></xccdf-1.2:description>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_samba">
            <xccdf-1.2:title xml:lang="en-US">Disable Samba if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Even after the Samba server package has been installed, it
will remain disabled. Do not enable this service unless it is
absolutely necessary to provide Microsoft Windows file and print
sharing functionality.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp">
          <xccdf-1.2:title xml:lang="en-US">SNMP Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The Simple Network Management Protocol allows
administrators to monitor the state of network devices, including
computers. Older versions of SNMP were well-known for weak
security, such as plaintext transmission of the community string
(used for authentication) and usage of easily-guessable
choices for the community string.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_snmp_service">
            <xccdf-1.2:title xml:lang="en-US">Disable SNMP Server if Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The system includes an SNMP daemon that allows for its remote
monitoring, though it not installed by default. If it was installed and
activated but is not needed, the software should be disabled and removed.</xccdf-1.2:description>
            </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_snmp_configure_server">
            <xccdf-1.2:title xml:lang="en-US">Configure SNMP Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If it is necessary to run the snmpd agent on the system, some best
practices should be followed to minimize the security risk from the
installation. The multiple security models implemented by SNMP cannot be fully
covered here so only the following general configuration advice can be offered:
<html:ul><html:li>use only SNMP version 3 security models and enable the use of authentication and encryption</html:li><html:li>write access to the MIB (Management Information Base) should be allowed only if necessary</html:li><html:li>all access to the MIB should be restricted following a principle of least privilege</html:li><html:li>network access should be limited to the maximum extent possible including restricting to expected network
addresses both in the configuration files and in the system firewall rules</html:li><html:li>ensure SNMP agents send traps only to, and accept SNMP queries only from, authorized management
stations</html:li><html:li>ensure that permissions on the <html:code>snmpd.conf</html:code> configuration file (by default, in <html:code>/etc/snmp</html:code>) are 640 or more restrictive</html:li><html:li>ensure that any MIB files' permissions are also 640 or more restrictive</html:li></html:ul></xccdf-1.2:description>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_snmpd_ro_string" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">SNMP read-only community string</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the SNMP community string used for read-only access.</xccdf-1.2:description>
              <xccdf-1.2:value>changemero</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_snmpd_rw_string" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">SNMP read-write community string</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the SNMP community string used for read-write access.</xccdf-1.2:description>
              <xccdf-1.2:value>changemerw</xccdf-1.2:value>
            </xccdf-1.2:Value>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh">
          <xccdf-1.2:title xml:lang="en-US">SSH Server</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The SSH protocol is recommended for remote login and
remote file transfer. SSH provides confidentiality and integrity
for data exchanged between two systems, as well as server
authentication, through the use of public key cryptography. The
implementation included with the system is called OpenSSH, and more
detailed documentation is available from its website,

    <html:a href="https://www.openssh.com">https://www.openssh.com</html:a>.
Its server program is called <html:code>sshd</html:code> and provided by the RPM package
<html:code>openssh-server</html:code>.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:machine"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_firewalld_sshd_zone" type="string">
            <xccdf-1.2:title xml:lang="en-US">SSH enabled firewalld zone</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify firewalld zone to enable SSH service. This value is used only for remediation purposes.</xccdf-1.2:description>
            <xccdf-1.2:value selector="block">block</xccdf-1.2:value>
            <xccdf-1.2:value>public</xccdf-1.2:value>
            <xccdf-1.2:value selector="dmz">dmz</xccdf-1.2:value>
            <xccdf-1.2:value selector="drop">drop</xccdf-1.2:value>
            <xccdf-1.2:value selector="external">external</xccdf-1.2:value>
            <xccdf-1.2:value selector="home">home</xccdf-1.2:value>
            <xccdf-1.2:value selector="internal">internal</xccdf-1.2:value>
            <xccdf-1.2:value selector="public">public</xccdf-1.2:value>
            <xccdf-1.2:value selector="trusted">trusted</xccdf-1.2:value>
            <xccdf-1.2:value selector="work">work</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_ciphers" type="string">
            <xccdf-1.2:title xml:lang="en-US">SSH Approved ciphers by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify the FIPS approved ciphers that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">aes256-ctr,aes192-ctr,aes128-ctr</xccdf-1.2:value>
            <xccdf-1.2:value>aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel7">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,blowfish-cbc,cast128-cbc,3des-cbc</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_approved_macs" type="string">
            <xccdf-1.2:title xml:lang="en-US">SSH Approved MACs by FIPS</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify the FIPS approved MACs (message authentication code) algorithms
	that are used for data integrity protection by the SSH server.</xccdf-1.2:description>
            <xccdf-1.2:value selector="stig">hmac-sha2-512,hmac-sha2-256</xccdf-1.2:value>
            <xccdf-1.2:value>hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_rhel7">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle12">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
            <xccdf-1.2:value selector="cis_sle15">umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-etm@openssh.com</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH session Idle time</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify duration of allowed idle time.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="120_minutes">7200</xccdf-1.2:value>
            <xccdf-1.2:value selector="14_minutes">840</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="60_minutes">3600</xccdf-1.2:value>
            <xccdf-1.2:value>300</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_listening_port" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH Server Listening Port</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify port the SSH server is listening.</xccdf-1.2:description>
            <xccdf-1.2:value>22</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH Max authentication attempts</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify the maximum number of authentication attempts per connection.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value>4</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_sshd_required" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH is required to be installed</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify if the Policy requires SSH to be installed. Used by SSH Rules
to determine if SSH should be uninstalled or configured.<html:br/>
A value of 0 means that the policy doesn't care if OpenSSH server is installed or not. If it is installed, scanner will check for it's configuration, if it's not installed, the check will pass.<html:br/>
A value of 1 indicates that OpenSSH server package is not required by the policy;<html:br/>
A value of 2 indicates that OpenSSH server package is required by the policy.<html:br/></xccdf-1.2:description>
            <xccdf-1.2:value>0</xccdf-1.2:value>
            <xccdf-1.2:value selector="no">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="yes">2</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_max_sessions" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH Max Sessions Count</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify the maximum number of open sessions permitted.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="4">4</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="2">2</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value>10</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSH Max Keep Alive Count</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Specify the maximum number of idle message counts before session is terminated.</xccdf-1.2:description>
            <xccdf-1.2:value selector="10">10</xccdf-1.2:value>
            <xccdf-1.2:value selector="3">3</xccdf-1.2:value>
            <xccdf-1.2:value selector="5">5</xccdf-1.2:value>
            <xccdf-1.2:value selector="0">0</xccdf-1.2:value>
            <xccdf-1.2:value selector="1">1</xccdf-1.2:value>
            <xccdf-1.2:value>0</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_client">
            <xccdf-1.2:title xml:lang="en-US">Configure OpenSSH Client if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The following configuration changes apply to the SSH client. They can
improve security parameters relwevant to the client user, e.g. increasing
entropy while generating initialization vectors. Note that these changes
influence only the default SSH client configuration. Changes in this group
can be overridden by the client user by modifying files within the
<html:pre>~/.ssh</html:pre> directory or by supplying parameters on the command line.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_ssh_server">
            <xccdf-1.2:title xml:lang="en-US">Configure OpenSSH Server if Necessary</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">If the system needs to act as an SSH server, then
certain changes should be made to the OpenSSH daemon configuration
file <html:code>/etc/ssh/sshd_config</html:code>. The following recommendations can be
applied to this file. See the <html:code>sshd_config(5)</html:code> man page for more
detailed information.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_size" type="string">
              <xccdf-1.2:title xml:lang="en-US">SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">default</xccdf-1.2:value>
              <xccdf-1.2:value>512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="512M">512M</xccdf-1.2:value>
              <xccdf-1.2:value selector="1G">1G</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_rekey_limit_time" type="string">
              <xccdf-1.2:title xml:lang="en-US">SSH RekeyLimit - size</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the size component of the rekey limit.</xccdf-1.2:description>
              <xccdf-1.2:value selector="sshd_default">none</xccdf-1.2:value>
              <xccdf-1.2:value>1h</xccdf-1.2:value>
              <xccdf-1.2:value selector="1hour">1h</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_disable_compression" type="string">
              <xccdf-1.2:title xml:lang="en-US">SSH Compression Setting</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify the compression setting for SSH connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="delayed">delayed</xccdf-1.2:value>
              <xccdf-1.2:value>no</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_priv_separation" type="string">
              <xccdf-1.2:title xml:lang="en-US">SSH Privilege Separation Setting</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Specify whether and how sshd separates privileges when handling incoming network connections.</xccdf-1.2:description>
              <xccdf-1.2:value selector="no">no</xccdf-1.2:value>
              <xccdf-1.2:value selector="yes">yes</xccdf-1.2:value>
              <xccdf-1.2:value selector="sandbox">sandbox</xccdf-1.2:value>
              <xccdf-1.2:value>sandbox</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups" type="string" interactive="true">
              <xccdf-1.2:title xml:lang="en-US">SSH MaxStartups setting</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Configure parameters for maximum concurrent unauthenticated connections to the SSH daemon.</xccdf-1.2:description>
              <xccdf-1.2:value>10:30:100</xccdf-1.2:value>
              <xccdf-1.2:value selector="10:30:60">10:30:60</xccdf-1.2:value>
            </xccdf-1.2:Value>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Set SSH Idle Timeout Interval</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">SSH allows administrators to set an idle timeout interval. After this interval
has passed, the idle user will be automatically logged out.
<html:br/><html:br/>
To set an idle timeout interval, edit the following line in <html:code>/etc/ssh/sshd_config</html:code> as
follows:
<html:pre>ClientAliveInterval <html:b><xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/></html:b></html:pre>
<html:br/><html:br/>
The timeout <html:b>interval</html:b> is given in seconds. For example, have a timeout
of 10 minutes, set <html:b>interval</html:b> to 600.
<html:br/><html:br/>
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made in <html:code>/etc/ssh/sshd_config</html:code>. Keep in mind that
some processes may stop SSH  from correctly detecting that the user is idle.</xccdf-1.2:description>
              <xccdf-1.2:warning xml:lang="en-US" category="dependency">SSH disconnecting idle clients will not have desired effect without also
configuring ClientAliveCountMax in the SSH service configuration.</xccdf-1.2:warning>
              <xccdf-1.2:warning xml:lang="en-US" category="general">Following conditions may prevent the SSH session to time out:
<html:ul><html:li>Remote processes on the remote machine generates output. As the output has to be transferred over the network to the client, the timeout is reset every time such transfer happens.</html:li><html:li>Any <html:code>scp</html:code> or <html:code>sftp</html:code> activity by the same user to the host resets the timeout.</html:li></html:ul></xccdf-1.2:warning>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000126-GPOS-00066</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000395-GPOS-00175</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">Terminating an idle ssh session within a short time period reduces the window of
opportunity for unauthorized personnel to take control of a management session
enabled on the console or console port that has been let unattended.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive"/>
              <xccdf-1.2:fix id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


sshd_idle_timeout_value="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveInterval\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveInterval $sshd_idle_timeout_value" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="sshd_set_idle_timeout" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value sshd_idle_timeout_value # promote to variable
  set_fact:
    sshd_idle_timeout_value: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value" use="legacy"/>
  tags:
    - always

- name: Set SSH Idle Timeout Interval
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveInterval\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveInterval\s+
        line: ClientAliveInterval {{ sshd_idle_timeout_value }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_idle_timeout
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_idle_timeout_value:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-sshd_set_idle_timeout:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" selected="false" role="full" severity="medium">
              <xccdf-1.2:title xml:lang="en-US">Set SSH Client Alive Count Max</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">The SSH server sends at most <html:code>ClientAliveCountMax</html:code> messages
during a SSH session and waits for a response from the SSH client.
The option <html:code>ClientAliveInterval</html:code> configures timeout after
each <html:code>ClientAliveCountMax</html:code> message. If the SSH server does not
receive a response from the client, then the connection is considered idle
and terminated.
For SSH earlier than v8.2, a <html:code>ClientAliveCountMax</html:code> value of <html:code>0</html:code>
causes an idle timeout precisely when the <html:code>ClientAliveInterval</html:code> is set.
Starting with v8.2, a value of <html:code>0</html:code> disables the timeout functionality
completely. If the option is set to a number greater than <html:code>0</html:code>, then
the idle session will be disconnected after
<html:code>ClientAliveInterval * ClientAliveCountMax</html:code> seconds.</xccdf-1.2:description>
              <xccdf-1.2:reference href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R29)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">13</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">14</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">15</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">16</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">18</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.cisecurity.org/controls/">8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.fbi.gov/file-repository/cjis-security-policy-v5_5_20160601-2-1.pdf">5.5.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">APO13.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.01</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.02</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">BAI03.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS01.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS03.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.04</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.05</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.07</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS05.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.03</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isaca.org/resources/cobit">DSS06.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171.pdf">3.1.11</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000879</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001133</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-002361</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(a)(4)(i)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.308(b)(3)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.310(b)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(1)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.gpo.gov/fdsys/pkg/CFR-2007-title45-vol1/pdf/CFR-2007-title45-vol1-chapA-subchapC.pdf">164.312(e)(2)(ii)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.6.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.3.7.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116731">4.3.4.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 1.9</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.isa.org/templates/one-column.aspx?pageid=111294&amp;productId=116785">SR 6.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.12.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.14.2.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.18.1.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.6.1.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.7.1.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.1.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.2.6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.iso.org/standard/54534.html">A.9.4.5</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-004-3 R2.2.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.nerc.com/pa/Stand/Standard%20Purpose%20Statement%20DL/US_Standard_One-Stop-Shop.xlsx">CIP-007-3 R5.3.3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-2(5)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-12</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">AC-17(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">SC-10</xccdf-1.2:reference>
              <xccdf-1.2:reference href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf">CM-6(a)</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">DE.CM-3</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-1</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-4</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-6</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.AC-7</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf">PR.IP-2</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf">Req-8.1.8</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000163-GPOS-00072</xccdf-1.2:reference>
              <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000279-GPOS-00109</xccdf-1.2:reference>
              <xccdf-1.2:reference href="">SRG-OS-000480-VMM-002000</xccdf-1.2:reference>
              <xccdf-1.2:rationale xml:lang="en-US">This ensures a user login will be terminated as soon as the <html:code>ClientAliveInterval</html:code>
is reached.</xccdf-1.2:rationale>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
              <xccdf-1.2:requires idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout"/>
              <xccdf-1.2:fix id="sshd_set_keepalive" system="urn:xccdf:fix:script:sh"># Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; then


var_sshd_set_keepalive="<xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>"



if [ -e "/etc/ssh/sshd_config" ] ; then
    
    LC_ALL=C sed -i "/^\s*ClientAliveCountMax\s\+/Id" "/etc/ssh/sshd_config"
else
    touch "/etc/ssh/sshd_config"
fi
cp "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.bak"
# Insert before the line matching the regex '^Match'.
line_number="$(LC_ALL=C grep -n "^Match" "/etc/ssh/sshd_config.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
    # There was no match of '^Match', insert at
    # the end of the file.
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
else
    head -n "$(( line_number - 1 ))" "/etc/ssh/sshd_config.bak" &gt; "/etc/ssh/sshd_config"
    printf '%s\n' "ClientAliveCountMax $var_sshd_set_keepalive" &gt;&gt; "/etc/ssh/sshd_config"
    tail -n "+$(( line_number ))" "/etc/ssh/sshd_config.bak" &gt;&gt; "/etc/ssh/sshd_config"
fi
# Clean up after ourselves.
rm "/etc/ssh/sshd_config.bak"

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
              <xccdf-1.2:fix id="sshd_set_keepalive" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="low" strategy="restrict">- name: XCCDF Value var_sshd_set_keepalive # promote to variable
  set_fact:
    var_sshd_set_keepalive: !!str <xccdf-1.2:sub idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive" use="legacy"/>
  tags:
    - always

- name: Set SSH Client Alive Count Max
  block:

    - name: Check for duplicate values
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      check_mode: true
      changed_when: false
      register: dupes

    - name: Deduplicate values from /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: false
        regexp: (?i)^\s*ClientAliveCountMax\s+
        state: absent
      when: dupes.found is defined and dupes.found &gt; 1

    - name: Insert correct line to /etc/ssh/sshd_config
      lineinfile:
        path: /etc/ssh/sshd_config
        create: true
        regexp: (?i)^\s*ClientAliveCountMax\s+
        line: ClientAliveCountMax {{ var_sshd_set_keepalive }}
        state: present
        insertbefore: ^[#\s]*Match
        validate: /usr/sbin/sshd -t -f %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - CJIS-5.5.6
    - NIST-800-171-3.1.11
    - NIST-800-53-AC-12
    - NIST-800-53-AC-17(a)
    - NIST-800-53-AC-2(5)
    - NIST-800-53-CM-6(a)
    - NIST-800-53-SC-10
    - PCI-DSS-Req-8.1.8
    - low_complexity
    - low_disruption
    - medium_severity
    - no_reboot_needed
    - restrict_strategy
    - sshd_set_keepalive
</xccdf-1.2:fix>
              <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
                <xccdf-1.2:check-export export-name="oval:ssg-var_sshd_set_keepalive:var:1" value-id="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive"/>
                <xccdf-1.2:check-export export-name="oval:ssg-sshd_required:var:1" value-id="xccdf_org.ssgproject.content_value_sshd_required"/>
                <xccdf-1.2:check-content-ref name="oval:ssg-sshd_set_keepalive:def:1" href="ssg-fedora-oval.xml"/>
              </xccdf-1.2:check>
              <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
                <xccdf-1.2:check-content-ref name="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
              </xccdf-1.2:check>
            </xccdf-1.2:Rule>
            <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sshd_strengthen_firewall">
              <xccdf-1.2:title xml:lang="en-US">Strengthen Firewall Configuration if Possible</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">If the SSH server is expected to only receive connections from
the local network, then strengthen the default firewall rule for the SSH service
to only accept connections from the appropriate network segment(s).
<html:br/><html:br/>
Determine an appropriate network block, <html:code>netwk</html:code>, network mask, <html:code>mask</html:code>, and
network protocol, <html:code>ip_protocol</html:code>, representing the systems on your network which will
be allowed to access this SSH server.
<html:br/><html:br/>
Run the following command:
<html:pre>firewall-cmd --permanent --add-rich-rule='rule family="ip_protocol" source address="netwk/mask" service name="ssh" accept'</html:pre></xccdf-1.2:description>
              <xccdf-1.2:platform idref="cpe:/a:machine"/>
            </xccdf-1.2:Group>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd">
          <xccdf-1.2:title xml:lang="en-US">System Security Services Daemon</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/><html:br/>
For more information, see</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:sssd"/>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function" type="string" interactive="true">
            <xccdf-1.2:title xml:lang="en-US">SSSD certificate_verification option</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Value of the certificate_verification option in
the SSSD config.</xccdf-1.2:description>
            <xccdf-1.2:value selector="sha1">sha1</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha256">sha256</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha384">sha384</xccdf-1.2:value>
            <xccdf-1.2:value selector="sha512">sha512</xccdf-1.2:value>
            <xccdf-1.2:value>sha1</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSSD memcache_timeout option</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Value of the memcache_timeout option in the [nss] section
of SSSD config /etc/sssd/sssd.conf.</xccdf-1.2:description>
            <xccdf-1.2:value selector="3_minutes">180</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
            <xccdf-1.2:value>300</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout" type="number">
            <xccdf-1.2:title xml:lang="en-US">SSSD ssh_known_hosts_timeout option</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Value of the ssh_known_hosts_timeout option in the [ssh] section
of SSSD configuration file /etc/sssd/sssd.conf.</xccdf-1.2:description>
            <xccdf-1.2:value selector="3_minutes">180</xccdf-1.2:value>
            <xccdf-1.2:value selector="5_minutes">300</xccdf-1.2:value>
            <xccdf-1.2:value selector="10_minutes">600</xccdf-1.2:value>
            <xccdf-1.2:value selector="15_minutes">900</xccdf-1.2:value>
            <xccdf-1.2:value selector="30_minutes">1800</xccdf-1.2:value>
            <xccdf-1.2:value selector="1_day">86400</xccdf-1.2:value>
            <xccdf-1.2:value>180</xccdf-1.2:value>
          </xccdf-1.2:Value>
          <xccdf-1.2:Rule id="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" selected="false" role="full" severity="medium">
            <xccdf-1.2:title xml:lang="en-US">Enable Smartcards in SSSD</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">SSSD should be configured to authenticate access to the system
using smart cards. To enable smart cards in SSSD, set <html:code>pam_cert_auth</html:code>
to <html:code>true</html:code> under the <html:code>[pam]</html:code>
section in <html:code>/etc/sssd/sssd.conf</html:code>. For example:
<html:pre>[pam]
pam_cert_auth = true
</html:pre></xccdf-1.2:description>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-001954</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/cci/">CCI-000765</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0421</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0422</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0431</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">0974</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1173</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1401</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1504</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1505</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1546</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1557</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1558</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1559</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1560</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">1561</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000375-GPOS-00160</xccdf-1.2:reference>
            <xccdf-1.2:reference href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000105-GPOS-00052</xccdf-1.2:reference>
            <xccdf-1.2:reference href="">SRG-OS-000107-VMM-000530</xccdf-1.2:reference>
            <xccdf-1.2:rationale xml:lang="en-US">Using an authentication device, such as a CAC or token that is separate from
the information system, ensures that even if the information system is
compromised, that compromise will not affect credentials stored on the
authentication device.
<html:br/><html:br/>
Multifactor solutions that require devices separate from
information systems gaining access include, for example, hardware tokens
providing time-based or challenge-response authenticators and smart cards such
as the U.S. Government Personal Identity Verification card and the DoD Common
Access Card.</xccdf-1.2:rationale>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:fix id="sssd_enable_smartcards" system="urn:xccdf:fix:script:sh" complexity="low" disruption="medium" strategy="configure"># Remediation is applicable only in certain platforms
if rpm --quiet -q sssd-common &amp;&amp; { [ ! -f /.dockerenv ] &amp;&amp; [ ! -f /run/.containerenv ]; }; then

SSSD_CONF="/etc/sssd/sssd.conf"
SSSD_OPT="pam_cert_auth"
SSSD_OPT_VAL=true
PAM_REGEX="[[:space:]]*\[pam]"
PAM_OPT_REGEX="${PAM_REGEX}([^\n\[]*\n+)+?[[:space:]]*${SSSD_OPT}"

if grep -qzosP $PAM_OPT_REGEX $SSSD_CONF; then
	sed -i "s/${SSSD_OPT}[^(\n)]*/${SSSD_OPT} = ${SSSD_OPT_VAL}/" $SSSD_CONF
elif grep -qs $PAM_REGEX $SSSD_CONF; then
	sed -i "/$PAM_REGEX/a ${SSSD_OPT} = ${SSSD_OPT_VAL}" $SSSD_CONF
else
	mkdir -p /etc/sssd
	touch $SSSD_CONF
	echo -e "[pam]\n${SSSD_OPT} = ${SSSD_OPT_VAL}" &gt;&gt; $SSSD_CONF
fi

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>
            <xccdf-1.2:fix id="sssd_enable_smartcards" system="urn:xccdf:fix:script:ansible" complexity="low" disruption="medium" strategy="configure">- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Test for domain group
  command: grep '^\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: true
  changed_when: false
  check_mode: false
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Add default domain group (if no domain there)
  ini_file:
    path: /etc/sssd/sssd.conf
    section: '{{ item.section }}'
    option: '{{ item.option }}'
    value: '{{ item.value }}'
    create: true
    mode: 384
  with_items:
    - section: sssd
      option: domains
      value: default
    - section: domain/default
      option: id_provider
      value: files
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length &lt; 1
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards

- name: Enable Smartcards in SSSD
  ini_file:
    dest: /etc/sssd/sssd.conf
    section: pam
    option: pam_cert_auth
    value: 'true'
    create: true
    mode: 384
  when:
    - '"sssd-common" in ansible_facts.packages'
    - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
    - configure_strategy
    - low_complexity
    - medium_disruption
    - medium_severity
    - no_reboot_needed
    - sssd_enable_smartcards
</xccdf-1.2:fix>
            <xccdf-1.2:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <xccdf-1.2:check-content-ref name="oval:ssg-sssd_enable_smartcards:def:1" href="ssg-fedora-oval.xml"/>
            </xccdf-1.2:check>
            <xccdf-1.2:check system="http://scap.nist.gov/schema/ocil/2">
              <xccdf-1.2:check-content-ref name="ocil:ssg-sssd_enable_smartcards_ocil:questionnaire:1" href="ssg-fedora-ocil.xml"/>
            </xccdf-1.2:check>
          </xccdf-1.2:Rule>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_sssd-ldap">
            <xccdf-1.2:title xml:lang="en-US">System Security Services Daemon (SSSD) - LDAP</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The System Security Services Daemon (SSSD) is a system daemon that provides access
to different identity and authentication providers such as Red Hat's IdM, Microsoft's AD,
openLDAP, MIT Kerberos, etc. It uses a common framework that can provide caching and offline
support to systems utilizing SSSD. SSSD using caching to reduce load on authentication
servers permit offline authentication as well as store extended user data.
<html:br/><html:br/>
SSSD can support many backends including LDAP. The <html:code>sssd-ldap</html:code> backend
allows SSSD to fetch identity information from an LDAP server.</xccdf-1.2:description>
            <xccdf-1.2:platform idref="cpe:/a:machine"/>
            <xccdf-1.2:Value id="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir" type="string">
              <xccdf-1.2:title xml:lang="en-US">SSSD LDAP Backend Client CA Certificate Location</xccdf-1.2:title>
              <xccdf-1.2:description xml:lang="en-US">Path of a directory that contains Certificate Authority certificates.</xccdf-1.2:description>
              <xccdf-1.2:value>/etc/openldap/cacerts</xccdf-1.2:value>
            </xccdf-1.2:Value>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_usbguard">
          <xccdf-1.2:title xml:lang="en-US">USBGuard daemon</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The USBGuard daemon enforces the USB device authorization policy for all USB devices.</xccdf-1.2:description>
          <xccdf-1.2:platform idref="cpe:/a:not_s390x_arch"/>
          </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_xwindows">
          <xccdf-1.2:title xml:lang="en-US">X Window System</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The X Window System implementation included with the
system is called X.org.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_disabling_xwindows">
            <xccdf-1.2:title xml:lang="en-US">Disable X Windows</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Unless there is a mission-critical reason for the
system to run a graphical user interface, ensure X is not set to start
automatically at boot and remove the X Windows software packages.
There is usually no reason to run X Windows
on a dedicated server system, as it increases the system's attack surface and consumes
system resources. Administrators of server systems should instead login via
SSH or on the text console.</xccdf-1.2:description>
            </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
      <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro">
        <xccdf-1.2:title xml:lang="en-US">Introduction</xccdf-1.2:title>
        <xccdf-1.2:description xml:lang="en-US">The purpose of this guidance is to provide security configuration
recommendations and baselines for the Fedora operating
system. Recommended settings for the basic operating system are provided,
as well as for many network services that the system can provide to other systems.
The guide is intended for system administrators. Readers are assumed to
possess basic system administration skills for Unix-like systems, as well
as some familiarity with the product's documentation and administration
conventions. Some instructions within this guide are complex.
All directions should be followed completely and with understanding of
their effects in order to avoid serious adverse effects on the system
and its security.</xccdf-1.2:description>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_general-principles">
          <xccdf-1.2:title xml:lang="en-US">General Principles</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">The following general principles motivate much of the advice in this
guide and should also influence any configuration decisions that are
not explicitly covered.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-encrypt-transmitted-data">
            <xccdf-1.2:title xml:lang="en-US">Encrypt Transmitted Data Whenever Possible</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Data transmitted over a network, whether wired or wireless, is susceptible
to passive monitoring. Whenever practical solutions for encrypting
such data exist, they should be applied. Even if data is expected to
be transmitted only over a local network, it should still be encrypted.
Encrypting authentication data, such as passwords, is particularly
important. Networks of Fedora machines can and should be configured
so that no unencrypted authentication data is ever transmitted between
machines.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-least-privilege">
            <xccdf-1.2:title xml:lang="en-US">Least Privilege</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Grant the least privilege necessary for user accounts and software to perform tasks.
For example, <html:code>sudo</html:code> can be implemented to limit authorization to super user
accounts on the system only to designated personnel. Another example is to limit
logins on server systems to only those administrators who need to log into them in
order to perform administration tasks. Using SELinux also follows the principle of
least privilege: SELinux policy can confine software to perform only actions on the
system that are specifically allowed. This can be far more restrictive than the
actions permissible by the traditional Unix permissions model.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-minimize-software">
            <xccdf-1.2:title xml:lang="en-US">Minimize Software to Minimize Vulnerability</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">The simplest way to avoid vulnerabilities in software is to avoid
installing that software. On Fedora,the RPM Package Manager (originally Red Hat Package Manager, abbreviated RPM)
allows for careful management of
the set of software packages installed on a system. Installed software
contributes to system vulnerability in several ways. Packages that
include setuid programs may provide local attackers a potential path to
privilege escalation. Packages that include network services may give
this opportunity to network-based attackers. Packages that include
programs which are predictably executed by local users (e.g. after
graphical login) may provide opportunities for trojan horses or other
attack code to be run undetected. The number of software packages
installed on a system can almost always be significantly pruned to include
only the software for which there is an environmental or operational need.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-separate-servers">
            <xccdf-1.2:title xml:lang="en-US">Run Different Network Services on Separate Systems</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Whenever possible, a server should be dedicated to serving exactly one
network service. This limits the number of other services that can
be compromised in the event that an attacker is able to successfully
exploit a software flaw in one network service.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_principle-use-security-tools">
            <xccdf-1.2:title xml:lang="en-US">Configure Security Tools to Improve System Robustness</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Several tools exist which can be effectively used to improve a system's
resistance to and detection of unknown attacks. These tools can improve
robustness against attack at the cost of relatively little configuration
effort. In particular, this guide recommends and discusses the use of
host-based firewalling, SELinux for protection against
vulnerable services, and a logging and auditing infrastructure for
detection of problems.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
        <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_how-to-use">
          <xccdf-1.2:title xml:lang="en-US">How to Use This Guide</xccdf-1.2:title>
          <xccdf-1.2:description xml:lang="en-US">Readers should heed the following points when using the guide.</xccdf-1.2:description>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-formatting-conventions">
            <xccdf-1.2:title xml:lang="en-US">Formatting Conventions</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Commands intended for shell execution, as well as configuration file text,
are featured in a <html:code>monospace font</html:code>. <html:i>Italics</html:i> are used
to indicate instances where the system administrator must substitute
the appropriate information into a command or configuration file.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-read-sections-completely">
            <xccdf-1.2:title xml:lang="en-US">Read Sections Completely and in Order</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Each section may build on information and recommendations discussed in
prior sections. Each section should be read and understood completely;
instructions should never be blindly applied. Relevant discussion may
occur after instructions for an action.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-reboot-required">
            <xccdf-1.2:title xml:lang="en-US">Reboot Required</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">A system reboot is implicitly required after some actions in order to
complete the reconfiguration of the system. In many cases, the changes
will not take effect until a reboot is performed. In order to ensure
that changes are applied properly and to test functionality, always
reboot the system after applying a set of recommendations from this guide.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-root-shell-assumed">
            <xccdf-1.2:title xml:lang="en-US">Root Shell Environment Assumed</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">Most of the actions listed in this document are written with the
assumption that they will be executed by the root user running the
<html:code>/bin/bash</html:code> shell. Commands preceded with a hash mark (#)
assume that the administrator will execute the commands as root, i.e.
apply the command via <html:code>sudo</html:code> whenever possible, or use
<html:code>su</html:code> to gain root privileges if <html:code>sudo</html:code> cannot be
used. Commands which can be executed as a non-root user are are preceded
by a dollar sign ($) prompt.</xccdf-1.2:description>
          </xccdf-1.2:Group>
          <xccdf-1.2:Group id="xccdf_org.ssgproject.content_group_intro-test-non-production">
            <xccdf-1.2:title xml:lang="en-US">Test in Non-Production Environment</xccdf-1.2:title>
            <xccdf-1.2:description xml:lang="en-US">This guidance should always be tested in a non-production environment
before deployment. This test environment should simulate the setup in
which the system will be deployed as closely as possible.</xccdf-1.2:description>
          </xccdf-1.2:Group>
        </xccdf-1.2:Group>
      </xccdf-1.2:Group>
    </xccdf-1.2:Benchmark>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-oval.xml" timestamp="2021-09-30T00:00:00">
    <oval-def:oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd         http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
      <oval-def:generator>
        <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
        <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
        <oval:schema_version>5.11</oval:schema_version>
        <oval:timestamp>2021-09-30T00:00:00</oval:timestamp>
      </oval-def:generator>
      <oval-def:definitions>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS6 is installed" test_ref="oval:ssg-test_centos6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="CentOS7 is installed" test_ref="oval:ssg-test_centos7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_centos8:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>CentOS 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:centos:centos:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      CentOS 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="OS is CentOS" test_ref="oval:ssg-test_centos8_name:tst:1"/>
            <oval-def:criterion comment="OS version is 8" test_ref="oval:ssg-test_centos8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Debian</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is a Debian System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Debian" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian10:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian Linux 10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 10</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="Debian Linux is version 10" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian10 is installed" test_ref="oval:ssg-test_debian_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_debian9:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Debian 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:debian:debian_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Debian 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Debian version is Debian Stretch" operator="AND">
            <oval-def:extend_definition comment="Debian is installed" definition_ref="oval:ssg-installed_OS_is_debian:def:1"/>
            <oval-def:criterion comment="Debian9 is installed" test_ref="oval:ssg-test_debian_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_fedora:def:1" version="3">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is Fedora</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:33" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:34" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:fedoraproject:fedora:35" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Fedora</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="fedora-release RPM packages are installed" test_ref="oval:ssg-test_fedora_release_rpm:tst:1"/>
            <oval-def:criterion comment="CPE vendor is 'fedoraproject' and product is 'fedora'" test_ref="oval:ssg-test_fedora_vendor_product:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 7 System is installed" test_ref="oval:ssg-test_ol7_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Oracle Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:oracle:linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Oracle Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Oracle Linux 8 System is installed" test_ref="oval:ssg-test_ol8_system:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is openSUSE.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="openSUSE is installed" test_ref="oval:ssg-test_opensuse_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:15.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 15.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 15 is installed" test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>openSUSE Leap 42</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.1" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.2" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:opensuse:leap:42.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is openSUSE Leap 42.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="openSUSE is installed" definition_ref="oval:ssg-installed_OS_is_opensuse:def:1"/>
            <oval-def:criterion comment="openSUSE Leap 42 is installed" test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Installed operating system is part of the Unix family</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed on the system is part of the Unix OS family</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_family:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux CoreOS</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux_coreos:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criteria operator="AND">
              <oval-def:criterion comment="RHCOS is installed" test_ref="oval:ssg-test_rhcos:tst:1"/>
              <oval-def:criterion comment="RHCOS version 4 is installed" test_ref="oval:ssg-test_rhcos4:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel7_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 7 Client is installed" test_ref="oval:ssg-test_rhel7_client:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Workstation is installed" test_ref="oval:ssg-test_rhel7_workstation:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Server is installed" test_ref="oval:ssg-test_rhel7_server:tst:1"/>
              <oval-def:criterion comment="RHEL 7 Compute Node is installed" test_ref="oval:ssg-test_rhel7_computenode:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 7" test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel8_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 8 is installed" test_ref="oval:ssg-test_rhel8:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 8" test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.0</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.0" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.0 is installed" test_ref="oval:ssg-test_rhel8_0:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.1</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.1" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.1 is installed" test_ref="oval:ssg-test_rhel8_1:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.2</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.2" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.2 is installed" test_ref="oval:ssg-test_rhel8_2:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.3</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.3" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.3 is installed" test_ref="oval:ssg-test_rhel8_3:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.4 is installed" test_ref="oval:ssg-test_rhel8_4:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.5</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.5" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.5 is installed" test_ref="oval:ssg-test_rhel8_5:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.6 is installed" test_ref="oval:ssg-test_rhel8_6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.7 is installed" test_ref="oval:ssg-test_rhel8_7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.8" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.8 is installed" test_ref="oval:ssg-test_rhel8_8:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.9 is installed" test_ref="oval:ssg-test_rhel8_9:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 8.10</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:8.10" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="RHEL 8.10 is installed" test_ref="oval:ssg-test_rhel8_10:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhel9:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Enterprise Linux 9</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:enterprise_linux:9" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_rhel9_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="RHEL 9 is installed" test_ref="oval:ssg-test_rhel9:tst:1"/>
              <oval-def:criteria operator="AND" comment="Red Hat Enterprise Virtualization Host is installed">
                <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
                <oval-def:criterion comment="Red Hat Enterprise Virtualization Host is based on RHEL 9" test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1"/>
              </oval-def:criteria>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:extend_definition comment="RHEL8 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel8:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Host (RHVH)" test_ref="oval:ssg-test_rhvh4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl6:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 6</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:6" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 6</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 6 is installed" test_ref="oval:ssg-test_sl6:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sl7:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Scientific Linux 7</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:scientificlinux:scientificlinux:7" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Scientific Linux 7</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="Scientific Linux 7 is installed" test_ref="oval:ssg-test_sl7:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle12:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 12</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:12" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:12" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle12_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 12 Desktop is installed" test_ref="oval:ssg-test_sle12_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 12 Server is installed" test_ref="oval:ssg-test_sle12_server:tst:1"/>
              <oval-def:criterion comment="SLES 12 for SAP Applications is installed" test_ref="oval:ssg-test_sles_12_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_sle15:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SUSE Linux Enterprise 15</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_server:15" source="CPE"/>
            <oval-def:reference ref_id="cpe:/o:suse:linux_enterprise_desktop:15" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_sle15_unix_family:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="SLE 15 Desktop is installed" test_ref="oval:ssg-test_sle15_desktop:tst:1"/>
              <oval-def:criterion comment="SLE 15 Server is installed" test_ref="oval:ssg-test_sle15_server:tst:1"/>
              <oval-def:criterion comment="SLES 15 for SAP Applications is installed" test_ref="oval:ssg-test_sles_15_for_sap:tst:1"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>The operating system installed is an Ubuntu System</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="System is Ubuntu" operator="AND">
            <oval-def:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>
            <oval-def:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>
            <oval-def:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1604</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1604</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Xenial" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 1804</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:18.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 1804</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Bionic" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Bionic is installed" test_ref="oval:ssg-test_ubuntu_bionic:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Ubuntu 2004</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:canonical:ubuntu_linux:20.04" source="CPE"/>
            <oval-def:description>The operating system installed on the system is Ubuntu 2004</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current Ubuntu version is Focal" operator="AND">
            <oval-def:extend_definition comment="Ubuntu is installed" definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1"/>
            <oval-def:criterion comment="Focal is installed" test_ref="oval:ssg-test_ubuntu_focal:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 1019</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 1019</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux1019:tst:1"/>
            <oval-def:criterion comment="Produce name is WRLinux" test_ref="oval:ssg-test_wrlinux1019_name:tst:1"/>
            <oval-def:criterion comment="WRLinux version is 1019" test_ref="oval:ssg-test_wrlinux1019_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>WRLinux 8</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/o:windriver:wrlinux" source="CPE"/>
            <oval-def:description>The operating system installed on the system is
      Wind River Linux 8</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria comment="current WRLinux version is WRLinux8" operator="AND">
            <oval-def:criterion comment="Installed operating system is part of the unix family" test_ref="oval:ssg-test_unix_wrlinux8:tst:1"/>
            <oval-def:criterion comment="WRLinux 8 is installed" test_ref="oval:ssg-test_wrlinux8_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhosp10:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat OpenStack Platform</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:openstack:10" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat OpenStack Platform 10.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="OpenStack is installed" test_ref="oval:ssg-test_rhosp10_release:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhosp13:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat OpenStack Platform</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:openstack:13.0" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat OpenStack Platform 13.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="OpenStack is installed" test_ref="oval:ssg-test_rhosp13_release:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_app_is_rhv4:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Red Hat Virtualization 4</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:reference ref_id="cpe:/a:redhat:virtualization:4" source="CPE"/>
            <oval-def:description>The application installed installed on the system is
      Red Hat Virtualization 4.</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="RHEL7 OS installed" definition_ref="oval:ssg-installed_OS_is_rhel7:def:1"/>
            <oval-def:criterion comment="Red Hat Virtualization Manager (RHVM)" test_ref="oval:ssg-test_rhevm4_version:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_audit_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package audit is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package audit is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:audit" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package audit is installed" test_ref="oval:ssg-test_env_has_audit_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_chrony_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package chrony is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package chrony is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:chrony" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package chrony is installed" test_ref="oval:ssg-test_env_has_chrony_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_gdm_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package gdm is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package gdm is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:gdm" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package gdm is installed" test_ref="oval:ssg-test_env_has_gdm_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_grub2_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package grub2 is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package grub2-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:grub2" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria operator="AND">
            <oval-def:criterion comment="Package grub2-common is installed" test_ref="oval:ssg-test_env_has_grub2_installed:tst:1"/>
            <oval-def:criteria operator="OR">
              <oval-def:criterion comment="Test for ppcle64 architecture" test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true"/>
              <oval-def:criterion comment="Test if OPAL is not used" test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true"/>
            </oval-def:criteria>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_libuser_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package libuser is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package libuser is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:libuser" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package libuser is installed" test_ref="oval:ssg-test_env_has_libuser_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_login_defs:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package providing /etc/login.defs is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package providing /etc/login.defs and is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:login_defs" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package providing /etc/login.defs is installed" test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package net-snmp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package net-snmp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:net-snmp" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package net-snmp is installed" test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package nss-pam-ldapd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package nss-pam-ldapd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:nss-pam-ldapd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package nss-pam-ldapd is installed" test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_ntp_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package ntp is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package ntp is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:ntp" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package ntp is installed" test_ref="oval:ssg-test_env_has_ntp_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_pam_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package pam is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package pam is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:pam" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package pam is installed" test_ref="oval:ssg-test_env_has_pam_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_postfix_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package postfix is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package postfix is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:postfix" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package postfix is installed" test_ref="oval:ssg-test_env_has_postfix_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sssd-common is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sssd-common is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sssd-common is installed" test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_sudo_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package sudo is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package sudo is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sudo" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package sudo is installed" test_ref="oval:ssg-test_env_has_sudo_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_systemd_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package systemd is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package systemd is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:systemd" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package systemd is installed" test_ref="oval:ssg-test_env_has_systemd_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_yum_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Package yum is installed</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if package yum is installed.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:yum" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package yum is installed" test_ref="oval:ssg-test_env_has_yum_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_has_zipl_package:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>System uses zIPL</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Checks if system uses zIPL bootloader.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:zipl" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Package s390utils-base is installed" test_ref="oval:ssg-test_env_has_zipl_installed:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_container:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a container</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for presence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:container" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria operator="OR">
            <oval-def:criterion comment="Check if /.dockerenv exists" test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1"/>
            <oval-def:criterion comment="Check if /run/.containerenv exists" test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-installed_env_is_a_machine:def:1" version="2">
          <oval-def:metadata>
            <oval-def:title>Check if the scan target is a machine</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check for absence of files characterizing container filesystems.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:machine" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="If environment is not a container, it is machine" definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test for different architecture than s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition comment="Architecture is not s390x" definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Test that the architecture is s390x</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</oval-def:description>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Architecture is s390x" test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>SSSD is configured to use LDAP</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Identification provider is not set to ad within /etc/sssd/sssd.conf</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:sssd-ldap" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion comment="Identification provider is not set to ad within /etc/sssd/sssd.conf" test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>Non-UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if System boot mode is non-UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:non-uefi" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
          </oval-def:criteria>
        </oval-def:definition>
        <oval-def:definition class="inventory" id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1">
          <oval-def:metadata>
            <oval-def:title>UEFI system boot mode check</oval-def:title>
            <oval-def:affected family="unix">
              <oval-def:platform>Fedora</oval-def:platform>
            </oval-def:affected>
            <oval-def:description>Check if system boot mode is UEFI.</oval-def:description>
            <oval-def:reference ref_id="cpe:/a:uefi" source="CPE"/>
          </oval-def:metadata>
          <oval-def:criteria>
            <oval-def:criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
          </oval-def:criteria>
        </oval-def:definition>
      </oval-def:definitions>
      <oval-def:tests>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 6" id="oval:ssg-test_centos6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="centos-release is version 7" id="oval:ssg-test_centos7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_centos7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_centos7:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check os-release ID" id="oval:ssg-test_centos8_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="Check os-release VERSION_ID" id="oval:ssg-test_centos8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/debian_version exists" id="oval:ssg-test_debian:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_debian:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_10:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Debian version" id="oval:ssg-test_debian_9:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="fedora-release RPM packages are installed" id="oval:ssg-test_fedora_release_rpm:tst:1" version="1">
          <linux:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora" id="oval:ssg-test_fedora_vendor_product:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 7" id="oval:ssg-test_ol7_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="oraclelinux-release is version 8" id="oval:ssg-test_ol8_system:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
          <linux:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE is installed" id="oval:ssg-test_opensuse_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 15 is installed" id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="openSUSE Leap 42 is installed" id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
          <linux:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test id="oval:ssg-test_unix_family:tst:1" check="all" check_existence="at_least_one_exists" comment="Test installed OS is part of the unix family" version="1">
          <ind:object object_ref="oval:ssg-object_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_family:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" comment="os-release is rhcos" id="oval:ssg-test_rhcos:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" comment="rhcoreos is version 4" id="oval:ssg-test_rhcos4:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel7_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-client is version 7" id="oval:ssg-test_rhel7_client:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-workstation is version 7" id="oval:ssg-test_rhel7_workstation:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-server is version 7" id="oval:ssg-test_rhel7_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release-computenode is version 7" id="oval:ssg-test_rhel7_computenode:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 7" id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel8_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8" id="oval:ssg-test_rhel8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.0" id="oval:ssg-test_rhel8_0:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.1" id="oval:ssg-test_rhel8_1:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.2" id="oval:ssg-test_rhel8_2:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.3" id="oval:ssg-test_rhel8_3:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.4" id="oval:ssg-test_rhel8_4:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.5" id="oval:ssg-test_rhel8_5:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.6" id="oval:ssg-test_rhel8_6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.7" id="oval:ssg-test_rhel8_7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.8" id="oval:ssg-test_rhel8_8:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.9" id="oval:ssg-test_rhel8_9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 8.10" id="oval:ssg-test_rhel8_10:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 8" id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_rhel9_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="redhat-release is version 9" id="oval:ssg-test_rhel9:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhel9:ste:1"/>
        </linux:rpminfo_test>
        <ind:textfilecontent54_test check="all" comment="RHEVH base RHEL is version 9" id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
          <ind:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="only_one_exists" comment="redhat-release-virtualization-host RPM package is installed" id="oval:ssg-test_rhvh4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 6" id="oval:ssg-test_sl6:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl6:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl6:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sl-release is version 7" id="oval:ssg-test_sl7:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sl7:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sl7:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle12_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 6" id="oval:ssg-test_sle12_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 6" id="oval:ssg-test_sle12_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 12" id="oval:ssg-test_sles_12_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_sle15_unix_family:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
          <ind:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
        </ind:family_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sled-release is version 15" id="oval:ssg-test_sle15_desktop:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="sles-release is version 15" id="oval:ssg-test_sle15_server:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="SLES_SAP-release is version 15" id="oval:ssg-test_sles_15_for_sap:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
          <linux:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="/etc/lsb-release exists" id="oval:ssg-test_lsb:tst:1" version="1">
          <unix:object object_ref="oval:ssg-obj_lsb:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu" id="oval:ssg-test_ubuntu:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_xenial:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_bionic:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check Ubuntu version" id="oval:ssg-test_ubuntu_focal:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_name:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux10.19 version" id="oval:ssg-test_wrlinux1019_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
        </ind:textfilecontent54_test>
        <ind:family_test check="all" check_existence="at_least_one_exists" comment="installed OS part of unix family" id="oval:ssg-test_unix_wrlinux8:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
          <ind:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
        </ind:family_test>
        <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check WRLinux8 version" id="oval:ssg-test_wrlinux8_version:tst:1" version="1">
          <ind:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
        </ind:textfilecontent54_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenStack is version 10" id="oval:ssg-test_rhosp10_release:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhosp10_release:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhosp10_release:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="OpenStack is version 13" id="oval:ssg-test_rhosp13_release:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhosp13_release:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhosp13_release:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" comment="rhevm4-appliance is installed" id="oval:ssg-test_rhevm4_version:tst:1" version="1">
          <linux:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
          <linux:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" comment="system has package audit installed">
          <linux:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" comment="package chrony is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" comment="system has package gdm installed">
          <linux:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" comment="system has package grub2-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /sys/firmware/opal exists" id="oval:ssg-test_system_using_opal:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
        </unix:file_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" comment="system has package libuser installed">
          <linux:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
          <linux:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" comment="system has package net-snmp installed">
          <linux:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" comment="system has package nss-pam-ldapd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" comment="package ntp is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" comment="system has package pam installed">
          <linux:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="all_exist" id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" comment="package postfix is installed">
          <linux:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" comment="system has package sssd-common installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" comment="system has package sudo installed">
          <linux:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" comment="system has package systemd installed">
          <linux:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" comment="system has package yum installed">
          <linux:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
        </linux:rpminfo_test>
        <linux:rpminfo_test check="all" check_existence="at_least_one_exists" id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" comment="system has package zipl installed">
          <linux:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
        </linux:rpminfo_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /.dockerenv exists" id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
        </unix:file_test>
        <unix:file_test check="all" check_existence="all_exist" comment="Check if /run/.containerenv exists" id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
        </unix:file_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="proc_sys_kernel is for s390x architecture" id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
          <ind:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
        </ind:textfilecontent54_test>
        <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="SSSD Configuration is set to use Active Directory" id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1">
          <ind:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
        </ind:textfilecontent54_test>
        <unix:file_test check="all" check_existence="at_least_one_exists" comment="Verify if /sys/firmware/efi folder exists" id="oval:ssg-test_efi_dir_existence:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
        </unix:file_test>
        <unix:uname_test check="all" comment="64 bit architecture" id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1">
          <unix:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
          <unix:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
        </unix:uname_test>
      </oval-def:tests>
      <oval-def:objects>
        <linux:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
          <linux:name>centos-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="check /etc/debian_version file" id="oval:ssg-obj_debian:obj:1" version="1">
          <unix:filepath>/etc/debian_version</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^10.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
          <ind:filepath>/etc/debian_version</ind:filepath>
          <ind:pattern operation="pattern match">^9.[0-9]+$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
          <linux:name operation="pattern match">fedora-release.*</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
          <ind:filepath>/etc/system-release-cpe</ind:filepath>
          <ind:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind:pattern>
          <ind:instance datatype="int" operation="equals">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
          <linux:name>oraclelinux-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
          <linux:name>openSUSE-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^ID="(\w+)"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
          <linux:name>redhat-release-client</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
          <linux:name>redhat-release-workstation</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
          <linux:name>redhat-release-server</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
          <linux:name>redhat-release-computenode</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
          <linux:name>redhat-release</linux:name>
        </linux:rpminfo_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
          <ind:filepath>/etc/redhat-release</ind:filepath>
          <ind:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind:pattern>
          <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
          <linux:name>redhat-release-virtualization-host</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
          <linux:name>sl-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <ind:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
          <linux:name>sled-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
          <linux:name>sles-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
          <linux:name>SLES_SAP-release</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="check /etc/lsb-release file" id="oval:ssg-obj_lsb:obj:1" version="1">
          <unix:filepath>/etc/lsb-release</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
          <ind:filepath>/etc/lsb-release</ind:filepath>
          <ind:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
          <ind:filepath>/etc/os-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.10\.19.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
        <ind:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
          <ind:filepath>/etc/wrlinux-release</ind:filepath>
          <ind:pattern operation="pattern match">^VERSION=.8\.0.*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhosp10_release:obj:1" version="1">
          <linux:name>rhosp-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhosp13_release:obj:1" version="1">
          <linux:name>rhosp-release</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
          <linux:name>rhvm-appliance</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
          <linux:name>audit</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
          <linux:name>chrony</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
          <linux:name>gdm</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
          <linux:name>grub2-common</linux:name>
        </linux:rpminfo_object>
        <unix:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
          <unix:filepath>/sys/firmware/opal</unix:filepath>
        </unix:file_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
          <linux:name>libuser</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
          <linux:name>shadow-utils</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
          <linux:name>net-snmp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
          <linux:name>nss-pam-ldapd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
          <linux:name>ntp</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
          <linux:name>pam</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
          <linux:name>postfix</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
          <linux:name>sssd-common</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
          <linux:name>sudo</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
          <linux:name>systemd</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
          <linux:name>yum</linux:name>
        </linux:rpminfo_object>
        <linux:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
          <linux:name>s390utils-base</linux:name>
        </linux:rpminfo_object>
        <unix:file_object comment="Check file /.dockerenv" id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1">
          <unix:filepath datatype="string">/.dockerenv</unix:filepath>
        </unix:file_object>
        <unix:file_object comment="Check file /run/.containerenv" id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1">
          <unix:filepath datatype="string">/run/.containerenv</unix:filepath>
        </unix:file_object>
        <ind:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
          <ind:filepath>/proc/sys/kernel/osrelease</ind:filepath>
          <ind:pattern operation="pattern match">^.*\.(.*)$</ind:pattern>
          <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
        </ind:textfilecontent54_object>
        <ind:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
          <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
          <ind:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind:pattern>
          <ind:instance datatype="int">1</ind:instance>
        </ind:textfilecontent54_object>
        <unix:file_object comment="/sys/firmware/efi" id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1">
          <unix:path>/sys/firmware/efi</unix:path>
          <unix:filename xsi:nil="true"/>
        </unix:file_object>
        <unix:uname_object comment="64 bit architecture" id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1"/>
      </oval-def:objects>
      <oval-def:states>
        <linux:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
          <ind:subexpression>centos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
          <ind:subexpression>8</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
          <linux:name operation="pattern match">openSUSE-release</linux:name>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
          <linux:version operation="pattern match">^42.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
          <ind:subexpression operation="pattern match">rhcos</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
          <ind:subexpression operation="pattern match">4</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">7</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
          <linux:version operation="pattern match">^8.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
          <linux:version operation="pattern match">^8.0*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
          <linux:version operation="pattern match">^8.1*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
          <linux:version operation="pattern match">^8.2*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
          <linux:version operation="pattern match">^8.3*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
          <linux:version operation="pattern match">^8.4*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
          <linux:version operation="pattern match">^8.5*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
          <linux:version operation="pattern match">^8.6*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
          <linux:version operation="pattern match">^8.7*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
          <linux:version operation="pattern match">^8.8*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
          <linux:version operation="pattern match">^8.9*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
          <linux:version operation="pattern match">^8.10*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">8</ind:subexpression>
        </ind:textfilecontent54_state>
        <ind:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
          <linux:version operation="pattern match">^9.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
          <ind:subexpression operation="pattern match">9</ind:subexpression>
        </ind:textfilecontent54_state>
        <linux:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
          <linux:evr datatype="evr_string" operation="greater than or equal">0:4.4</linux:evr>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
          <linux:version operation="pattern match">^6.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
          <linux:version operation="pattern match">^7.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^12.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
          <linux:version operation="pattern match">^15.*$</linux:version>
        </linux:rpminfo_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <ind:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
          <ind:family>unix</ind:family>
        </ind:family_state>
        <linux:rpminfo_state id="oval:ssg-state_rhosp10_release:ste:1" version="1">
          <linux:version operation="pattern match">^10.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhosp13_release:ste:1" version="1">
          <linux:version operation="pattern match">^13.*$</linux:version>
        </linux:rpminfo_state>
        <linux:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
          <linux:version operation="pattern match">^4.*$</linux:version>
        </linux:rpminfo_state>
        <ind:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
          <ind:subexpression datatype="string" operation="pattern match">^s390x$</ind:subexpression>
        </ind:textfilecontent54_state>
        <unix:uname_state comment="64 bit architecture" id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1">
          <unix:processor_type operation="equals">ppc64le</unix:processor_type>
        </unix:uname_state>
      </oval-def:states>
    </oval-def:oval_definitions>
  </ds:component>
  <ds:component id="scap_org.open-scap_comp_--builddir--build--BUILD--scap-security-guide-0.1.58--build--ssg-fedora-cpe-dictionary.xml" timestamp="2021-09-30T00:00:00">
    <cpe-dict:cpe-list xsi:schemaLocation="http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
      <cpe-dict:cpe-item name="cpe:/a:audit">
        <cpe-dict:title xml:lang="en-us">Package audit is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_audit_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:chrony">
        <cpe-dict:title xml:lang="en-us">Package chrony is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_chrony_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:gdm">
        <cpe-dict:title xml:lang="en-us">Package gdm is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_gdm_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:grub2">
        <cpe-dict:title xml:lang="en-us">Package grub2 is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_grub2_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:libuser">
        <cpe-dict:title xml:lang="en-us">Package libuser is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_libuser_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:login_defs">
        <cpe-dict:title xml:lang="en-us">Package providing /etc/login.defs is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_login_defs:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:machine">
        <cpe-dict:title xml:lang="en-us">Bare-metal or Virtual Machine</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_is_a_machine:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:net-snmp">
        <cpe-dict:title xml:lang="en-us">Package net-snmp is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_net-snmp_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:non-uefi">
        <cpe-dict:title xml:lang="en-us">System boot mode is non-UEFI</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-system_boot_mode_is_non_uefi:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:not_s390x_arch">
        <cpe-dict:title xml:lang="en-us">System architecture is not S390X</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:ntp">
        <cpe-dict:title xml:lang="en-us">Package ntp is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_ntp_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:pam">
        <cpe-dict:title xml:lang="en-us">Package pam is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_pam_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:postfix">
        <cpe-dict:title xml:lang="en-us">Package postfix is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_postfix_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:s390x_arch">
        <cpe-dict:title xml:lang="en-us">System architecture is S390X</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:sssd">
        <cpe-dict:title xml:lang="en-us">Package sssd-common is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_sssd-common_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:sudo">
        <cpe-dict:title xml:lang="en-us">Package sudo is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_sudo_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:uefi">
        <cpe-dict:title xml:lang="en-us">System boot mode is UEFI</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-system_boot_mode_is_uefi:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/a:yum">
        <cpe-dict:title xml:lang="en-us">Package yum is installed</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_env_has_yum_package:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:33">
        <cpe-dict:title xml:lang="en-us">Fedora 33</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:34">
        <cpe-dict:title xml:lang="en-us">Fedora 34</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
      <cpe-dict:cpe-item name="cpe:/o:fedoraproject:fedora:35">
        <cpe-dict:title xml:lang="en-us">Fedora 35</cpe-dict:title>
        <cpe-dict:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="ssg-fedora-cpe-oval.xml">oval:ssg-installed_OS_is_fedora:def:1</cpe-dict:check>
      </cpe-dict:cpe-item>
    </cpe-dict:cpe-list>
  </ds:component>
</ds:data-stream-collection>
      </arf:content>
    </arf:report-request>
  </arf:report-requests>
  <arf:assets>
    <arf:asset id="asset0">
      <ai:computing-device>
        <ai:connections>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v4>127.0.0.1</ai:ip-v4>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v4>10.0.2.100</ai:ip-v4>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v6>0:0:0:0:0:0:0:1</ai:ip-v6>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:ip-address>
              <ai:ip-v6>fe80:0:0:0:a08a:71ff:fe1f:ac82</ai:ip-v6>
            </ai:ip-address>
          </ai:connection>
          <ai:connection>
            <ai:mac-address>00:00:00:00:00:00</ai:mac-address>
          </ai:connection>
          <ai:connection>
            <ai:mac-address>A2:8A:71:1F:AC:82</ai:mac-address>
          </ai:connection>
        </ai:connections>
        <ai:fqdn>e98bca166d82</ai:fqdn>
        <ai:hostname>e98bca166d82</ai:hostname>
      </ai:computing-device>
    </arf:asset>
  </arf:assets>
  <arf:reports>
    <arf:report id="xccdf1">
      <arf:content>
        <TestResult xmlns="http://checklists.nist.gov/xccdf/1.2" id="xccdf_org.open-scap_testresult_xccdf_org.ssgproject.content_profile_pci-dss" start-time="2021-12-22T18:16:18+00:00" end-time="2021-12-22T18:16:24+00:00" version="0.1.58" test-system="cpe:/a:redhat:openscap:1.3.5">
          <benchmark href="#scap_org.open-scap_comp_ssg-fedora-xccdf-1.2.xml" id="xccdf_org.ssgproject.content_benchmark_FEDORA"/>
          <title>OSCAP Scan Result</title>
          <identity authenticated="false" privileged="false">root</identity>
          <profile idref="xccdf_org.ssgproject.content_profile_pci-dss"/>
          <target>e98bca166d82</target>
          <target-address>127.0.0.1</target-address>
          <target-address>10.0.2.100</target-address>
          <target-address>0:0:0:0:0:0:0:1</target-address>
          <target-address>fe80:0:0:0:a08a:71ff:fe1f:ac82</target-address>
          <target-facts>
            <fact name="urn:xccdf:fact:scanner:name" type="string">OpenSCAP</fact>
            <fact name="urn:xccdf:fact:scanner:version" type="string">1.3.5</fact>
            <fact name="urn:xccdf:fact:asset:identifier:fqdn" type="string">e98bca166d82</fact>
            <fact name="urn:xccdf:fact:asset:identifier:host_name" type="string">e98bca166d82</fact>
            <fact name="urn:xccdf:fact:ethernet:MAC" type="string">00:00:00:00:00:00</fact>
            <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">00:00:00:00:00:00</fact>
            <fact name="urn:xccdf:fact:ethernet:MAC" type="string">A2:8A:71:1F:AC:82</fact>
            <fact name="urn:xccdf:fact:asset:identifier:mac" type="string">A2:8A:71:1F:AC:82</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">127.0.0.1</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv4" type="string">10.0.2.100</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">::1</fact>
            <fact name="urn:xccdf:fact:asset:identifier:ipv6" type="string">fe80::a08a:71ff:fe1f:ac82</fact>
          </target-facts>
          <target-id-ref system="http://scap.nist.gov/schema/asset-identification/1.1" name="asset0" href=""/>
          <platform idref="cpe:/a:pam"/>
          <platform idref="cpe:/o:fedoraproject:fedora:33"/>
          <platform idref="cpe:/o:fedoraproject:fedora:34"/>
          <platform idref="cpe:/o:fedoraproject:fedora:35"/>
          <platform idref="cpe:/a:login_defs"/>
          <platform idref="cpe:/a:yum"/>
          <set-value idref="xccdf_org.ssgproject.content_value_function_populate"># The populate function isn't directly used by SSG at the moment but it can be 
# used for testing purposes and will be used in SSG Testsuite in the future.

function populate {
# code to populate environment variables needed (for unit testing)
if [ -z "${!1}" ]; then
	echo "$1 is not defined. Exiting."
	exit
fi
}</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_aide_scan_notification_email">root@localhost</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_size">512M</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_client_rekey_limit_time">1h</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy">DEFAULT</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcafee_antivirus_definition_expire">2592000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_inactivity_timeout_value">900</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_screensaver_lock_delay">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_dedicated_group">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_logfile">/var/log/sudo.log</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_passwd_timeout">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_timestamp_timeout">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sudo_umask">0022</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_login_banner_text">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm">SHA512</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny">6</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_fail_interval">900</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time">1800</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_delay">4000000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_remember_control_flag">requisite</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_tally2">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dcredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_dictcheck">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_difok">8</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_lcredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxclassrepeat">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_maxrepeat">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minclass">2</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_minlen">7</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ocredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_retry">3</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_ucredit">-1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smartcard_drivers">cac</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_authorized_local_users_regex">^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd|systemd-resolve|systemd-coredump|sssd|rngd)$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration">90</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs">90</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_minimum_age_login_defs">7</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_minlen_login_defs">15</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_password_warn_age_login_defs">7</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_password_pam_unix_rounds">5000</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_fail_delay">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_max_concurrent_login_sessions">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_tmout">600</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_accounts_user_umask">027</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_disk_full_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_network_failure_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_audispd_remote_server">logcollector</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_action_mail_acct">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_admin_space_left_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_error_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_disk_full_action">single</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_flush">data</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file">6</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_max_log_file_action">rotate</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_num_logs">5</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left">100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_action">email</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditd_space_left_percentage">25</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_file_groupowner_logfiles_value">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_file_owner_logfiles_value">root</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_rsyslog_remote_loghost_address">logcollector</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysconfig_network_IPV6_AUTOCONF_value">no</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_defrtr_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_pinfo_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_ra_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_autoconf_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_forwarding_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_max_addresses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_all_router_solicitations_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_defrtr_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_pinfo_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_ra_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_autoconf_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_forwarding_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_max_addresses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv6_conf_default_router_solicitations_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_log_martians_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_rp_filter_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_all_secure_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_accept_source_route_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_log_martians_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_rp_filter_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_conf_default_secure_redirects_value">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_invalid_ratelimit_value">500</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_rfc1337_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sysctl_net_ipv4_tcp_syncookies_value">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_removable_partition">/dev/cdrom</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_umask_for_daemons">022</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_policy_name">targeted</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinux_state">enforcing</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_handle_event">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_abrt_upload_watch_anon_write">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_can_scan_system">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_antivirus_use_jit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_auditadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_nsswitch_use_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_radius">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_authlogin_yubikey">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_awstats_purge_apache_log_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_boinc_execmem">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cdrecord_read_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_manage_all_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cluster_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cobbler_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_collectd_tcp_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_condor_tcp_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_conman_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_container_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_can_relabel">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_system_cronjob_use_shares">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cron_userdomain_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cups_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_cvs_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_dump_core">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_enable_cluster_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tcp_wrapper">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_daemons_use_tty">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dbadm_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_deny_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_deny_ptrace">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpc_exec_iptables">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_dhcpd_use_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_domain_fd_use">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_domain_kernel_load_modules">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_entropyd_use_audio">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_can_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_exim_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fcron_crond">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fenced_can_ssh">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_fips_mode">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_all_unreserved">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_full_access">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ftpd_use_passive_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_cgi_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_session_users">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_git_system_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gitosis_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_api_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_glance_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_global_ssp">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gluster_export_all_rw">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gpg_web_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_gssd_read_tmp">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_guest_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_haproxy_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_builtin_scripting">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_check_spam">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ftp">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_ldap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_mythtv">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_connect_zabbix">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_cobbler">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_connect_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_memcache">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_network_relay">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_avahi">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dbus_sssd">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_dontaudit_search_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_cgi">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_ftp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_graceful_shutdown">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_manage_ipa">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_ntlm_winbind">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_mod_auth_pam">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_read_user_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_ipa">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_preupgrade">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_run_stickshift">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_serve_cobbler_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_setrlimit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_ssi_exec">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_sys_script_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tmp_exec">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_tty_comm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_unified">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_gpg">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_openstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_use_sasl">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_verify_dns">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_icecast_use_any_tcp_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_irc_use_any_tcp_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_irssi_use_full_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kdumpgui_run_bootloader">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_kerberos_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ksmtuned_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_can_sendmail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_run_nagios_plugins">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logging_syslogd_use_tty">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_login_console_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logrotate_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_logwatch_can_network_connect_mail">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_lsmd_plugin_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mailman_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_client">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_exec_scripts">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_foreground">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mcelog_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_minidlna_read_generic_user_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mmap_low_allowed">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mock_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mount_anyfile">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_bind_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_bluejeans">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_gps">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_plugin_use_spice">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mozilla_read_content">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_enable_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mpd_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mplayer_execstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_mysql_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_pnp4nagios">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nagios_run_sudo">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_named_tcp_bind_http_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_named_write_master_zones">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_neutron_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_ro">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfs_export_all_rw">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nfsd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nis_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_nscd_use_shm">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openshift_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_can_network_connect">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_enable_homedirs">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_openvpn_run_unconfined">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pcp_read_generic_logs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_piranha_lvs_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_connect_all_unreserved">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_session_users">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_cifs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polipo_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_polyinstantiation_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_local_write_mail_spool">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_can_rsync">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_transmit_client_label">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_unconfined_dbadm">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postgresql_selinux_users_ddl">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_can_insmod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_pppd_for_user">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_privoxy_connect_any">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_prosody_bind_http_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_puppetagent_manage_all_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_puppetmaster_use_db">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_racoon_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_client">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rsync_full_access">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_create_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_domain_controller">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_enable_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_ro">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_export_all_rw">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_load_libgfapi">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_portmapper">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_run_unconfined">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_samba_share_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sanlock_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_saslauthd_read_shadow">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_insmod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_secure_mode_policyload">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_direct_dri_enabled">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execheap">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execmod">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_execstack">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_mysql_connect_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_ping">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_postgresql_connect_enabled">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_rw_noexattrfile">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_share_music">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_tcp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_udp_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_selinuxuser_use_ssh_chroot">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sge_domain_can_network_connect">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sge_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smartmon_3ware">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_smbd_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_spamassassin_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_spamd_enable_home_dirs">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_squid_connect_any">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_squid_use_tproxy">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_chroot_rw_homedirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_keysign">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_ssh_sysadm_login">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_staff_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_staff_use_svirt">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_swift_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sysadm_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_connect_all_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_telepathy_tcp_connect_generic_network_ports">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftp_home_dir">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tmpreaper_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tor_bind_all_unreserved_ports">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tor_can_network_relay">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_chrome_sandbox_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_login">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unconfined_mozilla_plugin_transition">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_unprivuser_use_svirt">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_ecryptfs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_fusefs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_lpd_server">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_nfs_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_use_samba_home_dirs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_user_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_varnishd_connect_any">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_read_qemu_ga_data">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_rw_qemu_ga_data">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_all_caps">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_audit">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_mknod">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_netlink">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_sandbox_use_sys_admin">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_transition_userdomain">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_comm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_fusefs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_rawip">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_samba">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_sanlock">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_usb">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_virt_use_xserver">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_manage_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_webadm_read_user_files">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_wine_mmap_zero_ignore">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_bind_vnc_tcp_port">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_exec_bootloader">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_sysadm_login">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xdm_write_home">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xen_use_nfs">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_blktap">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xend_run_qemu">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_connect_network">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_exec_content">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_mount_media">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xguest_use_bluetooth">true</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_clients_write_xshm">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_execmem">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_xserver_object_manager">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zabbix_can_network">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zarafa_setrlimit">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zebra_write_config">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_anon_write">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_zoneminder_run_sudo">false</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_httpd_loglevel">warn</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_max_keepalive_requests">100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_web_login_banner_text">^(You[\s\n]+are[\s\n]+accessing[\s\n]+a[\s\n]+U\.S\.[\s\n]+Government[\s\n]+\(USG\)[\s\n]+Information[\s\n]+System[\s\n]+\(IS\)[\s\n]+that[\s\n]+is[\s\n]+provided[\s\n]+for[\s\n]+USG\-authorized[\s\n]+use[\s\n]+only\.[\s\n]+By[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+\(which[\s\n]+includes[\s\n]+any[\s\n]+device[\s\n]+attached[\s\n]+to[\s\n]+this[\s\n]+IS\)\,[\s\n]+you[\s\n]+consent[\s\n]+to[\s\n]+the[\s\n]+following[\s\n]+conditions\:(?:[\n]+|(?:\\n)+)\-The[\s\n]+USG[\s\n]+routinely[\s\n]+intercepts[\s\n]+and[\s\n]+monitors[\s\n]+communications[\s\n]+on[\s\n]+this[\s\n]+IS[\s\n]+for[\s\n]+purposes[\s\n]+including\,[\s\n]+but[\s\n]+not[\s\n]+limited[\s\n]+to\,[\s\n]+penetration[\s\n]+testing\,[\s\n]+COMSEC[\s\n]+monitoring\,[\s\n]+network[\s\n]+operations[\s\n]+and[\s\n]+defense\,[\s\n]+personnel[\s\n]+misconduct[\s\n]+\(PM\)\,[\s\n]+law[\s\n]+enforcement[\s\n]+\(LE\)\,[\s\n]+and[\s\n]+counterintelligence[\s\n]+\(CI\)[\s\n]+investigations\.(?:[\n]+|(?:\\n)+)\-At[\s\n]+any[\s\n]+time\,[\s\n]+the[\s\n]+USG[\s\n]+may[\s\n]+inspect[\s\n]+and[\s\n]+seize[\s\n]+data[\s\n]+stored[\s\n]+on[\s\n]+this[\s\n]+IS\.(?:[\n]+|(?:\\n)+)\-Communications[\s\n]+using\,[\s\n]+or[\s\n]+data[\s\n]+stored[\s\n]+on\,[\s\n]+this[\s\n]+IS[\s\n]+are[\s\n]+not[\s\n]+private\,[\s\n]+are[\s\n]+subject[\s\n]+to[\s\n]+routine[\s\n]+monitoring\,[\s\n]+interception\,[\s\n]+and[\s\n]+search\,[\s\n]+and[\s\n]+may[\s\n]+be[\s\n]+disclosed[\s\n]+or[\s\n]+used[\s\n]+for[\s\n]+any[\s\n]+USG\-authorized[\s\n]+purpose\.(?:[\n]+|(?:\\n)+)\-This[\s\n]+IS[\s\n]+includes[\s\n]+security[\s\n]+measures[\s\n]+\(e\.g\.\,[\s\n]+authentication[\s\n]+and[\s\n]+access[\s\n]+controls\)[\s\n]+to[\s\n]+protect[\s\n]+USG[\s\n]+interests\-\-not[\s\n]+for[\s\n]+your[\s\n]+personal[\s\n]+benefit[\s\n]+or[\s\n]+privacy\.(?:[\n]+|(?:\\n)+)\-Notwithstanding[\s\n]+the[\s\n]+above\,[\s\n]+using[\s\n]+this[\s\n]+IS[\s\n]+does[\s\n]+not[\s\n]+constitute[\s\n]+consent[\s\n]+to[\s\n]+PM\,[\s\n]+LE[\s\n]+or[\s\n]+CI[\s\n]+investigative[\s\n]+searching[\s\n]+or[\s\n]+monitoring[\s\n]+of[\s\n]+the[\s\n]+content[\s\n]+of[\s\n]+privileged[\s\n]+communications\,[\s\n]+or[\s\n]+work[\s\n]+product\,[\s\n]+related[\s\n]+to[\s\n]+personal[\s\n]+representation[\s\n]+or[\s\n]+services[\s\n]+by[\s\n]+attorneys\,[\s\n]+psychotherapists\,[\s\n]+or[\s\n]+clergy\,[\s\n]+and[\s\n]+their[\s\n]+assistants\.[\s\n]+Such[\s\n]+communications[\s\n]+and[\s\n]+work[\s\n]+product[\s\n]+are[\s\n]+private[\s\n]+and[\s\n]+confidential\.[\s\n]+See[\s\n]+User[\s\n]+Agreement[\s\n]+for[\s\n]+details\.|I've[\s\n]+read[\s\n]+\&amp;[\s\n]+consent[\s\n]+to[\s\n]+terms[\s\n]+in[\s\n]+IS[\s\n]+user[\s\n]+agreem't\.)$</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_inet_interfaces">loopback-only</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_relayhost">smtp.$mydomain</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_postfix_root_mail_alias">system.administrator@mail.mil</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_multiple_time_servers">0.rhel.pool.ntp.org,1.rhel.pool.ntp.org,2.rhel.pool.ntp.org,3.rhel.pool.ntp.org</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_time_service_set_maxpoll">10</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_tftpd_secure_directory">/var/lib/tftpboot</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_ro_string">changemero</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_snmpd_rw_string">changemerw</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_firewalld_sshd_zone">public</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_ciphers">aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_approved_macs">hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_idle_timeout_value">900</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_listening_port">22</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_max_auth_tries_value">4</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_sshd_required">0</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_max_sessions">10</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_keepalive">1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_size">512M</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_rekey_limit_time">1h</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_disable_compression">no</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_priv_separation">sandbox</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sshd_set_maxstartups">10:30:100</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_certificate_verification_digest_function">sha1</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_memcache_timeout">300</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ssh_known_hosts_timeout">180</set-value>
          <set-value idref="xccdf_org.ssgproject.content_value_var_sssd_ldap_tls_ca_dir">/etc/openldap/cacerts</set-value>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_hashes" role="full" time="2021-12-22T18:16:23+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-rpm_verify_hashes:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rpm_verify_permissions" role="full" time="2021-12-22T18:16:23+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-rpm_verify_permissions:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_aide_installed" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_aide_build_database" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_bind_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_bind_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_system_crypto_policy:var:1" value-id="xccdf_org.ssgproject.content_value_var_system_crypto_policy"/>
              <check-content-ref name="oval:ssg-configure_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_kerberos_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_libreswan_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_libreswan_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_openssl_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_openssl_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-configure_ssh_crypto_policy:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_install_hids" role="full" time="2021-12-22T18:16:23+00:00" severity="high" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_db_up_to_date" role="full" time="2021-12-22T18:16:23+00:00" severity="high" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank" role="full" time="2021-12-22T18:16:23+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_fedora_gpgkey_installed" role="full" time="2021-12-22T18:16:24+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_fedora_gpgkey_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated" role="full" time="2021-12-22T18:16:24+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_gpgcheck_globally_activated:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled" role="full" time="2021-12-22T18:16:24+00:00" severity="high" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-ensure_gpgcheck_never_disabled:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" role="full" time="2021-12-22T18:16:24+00:00" severity="high" weight="1.000000">
            <result>notchecked</result>
            <message severity="info">No candidate or applicable check found.</message>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_display_login_attempts" role="full" time="2021-12-22T18:16:24+00:00" severity="low" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-display_login_attempts:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_unix_remember:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_unix_remember"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_unix_remember:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_deny"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_passwords_pam_faillock_unlock_time"/>
              <check-content-ref name="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_dcredit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_dcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_dcredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_dcredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_lcredit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_lcredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_lcredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_lcredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_minlen:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_minlen"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_minlen:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_pam_ucredit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_pam_ucredit:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_pam_ucredit"/>
              <check-content-ref name="oval:ssg-accounts_password_pam_ucredit:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_libuserconf" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_logindefs" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_password_hashing_algorithm:var:1" value-id="xccdf_org.ssgproject.content_value_var_password_hashing_algorithm"/>
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_opensc_installed" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_pcscd_enabled" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_configure_opensc_card_drivers" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_force_opensc_card_drivers" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_account_disable_post_pw_expiration:var:1" value-id="xccdf_org.ssgproject.content_value_var_account_disable_post_pw_expiration"/>
              <check-content-ref name="oval:ssg-account_disable_post_pw_expiration:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_account_unique_name" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-account_unique_name:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-export export-name="oval:ssg-var_accounts_maximum_age_login_defs:var:1" value-id="xccdf_org.ssgproject.content_value_var_accounts_maximum_age_login_defs"/>
              <check-content-ref name="oval:ssg-accounts_maximum_age_login_defs:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_gid_passwd_group_same" role="full" time="2021-12-22T18:16:24+00:00" severity="low" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-gid_passwd_group_same:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_no_empty_passwords" role="full" time="2021-12-22T18:16:24+00:00" severity="high" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_audispd-plugins_installed" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_immutable" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_mac_modification" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_media_export" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_session_events" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_sysadmin_actions" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_group" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_gshadow" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_opasswd" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_passwd" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_usergroup_modification_shadow" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_ownership_var_log_audit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_ftruncate" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_open_by_handle_at" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_openat" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_truncate" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_finit" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_login_events" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_stime" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_audit_rules_time_watch_localtime" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_audispd_syslog_plugin_activated" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_admin_space_left_action" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_max_log_file_action" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_num_logs" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_auditd_data_retention_space_left_action" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_ownership" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_rsyslog_files_permissions" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_ensure_logrotate_activated" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_package_libreswan_installed" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>fail</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-package_libreswan_installed:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_group" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_group:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_passwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_groupowner_etc_shadow:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_group" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_group:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_passwd" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_passwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_owner_etc_shadow" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_owner_etc_shadow:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_group" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_group:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_passwd" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_passwd:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_file_permissions_etc_shadow" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>pass</result>
            <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
              <check-content-ref name="oval:ssg-file_permissions_etc_shadow:def:1" href="#oval0"/>
            </check>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_service_chronyd_or_ntpd_enabled" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_multiple_servers" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_specify_remote_server" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_idle_timeout" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sshd_set_keepalive" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <rule-result idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcards" role="full" time="2021-12-22T18:16:24+00:00" severity="medium" weight="1.000000">
            <result>notapplicable</result>
          </rule-result>
          <score system="urn:xccdf:scoring:default" maximum="100.000000">55.208336</score>
        </TestResult>
      </arf:content>
    </arf:report>
    <arf:report id="oval0">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
            <oval:product_version>1.3.5</oval:product_version>
            <oval:schema_version>5.11</oval:schema_version>
            <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
              <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
              <oval:schema_version>5.11</oval:schema_version>
              <oval:timestamp>2021-09-30T00:00:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:ssg-xwindows_runlevel_target:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable X Windows Startup By Setting Default Target</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="xwindows_runlevel_target"/>
                  <description>Ensure that the default runlevel target is set to multi-user.target.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" comment="default.target systemd softlink exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-wireless_disable_interfaces:def:1" version="1" class="compliance">
                <metadata>
                  <title>Deactivate Wireless Network Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="wireless_disable_interfaces"/>
                  <description>All wireless interfaces should be disabled.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1" comment="query /proc/net/wireless"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_umask_for_daemons' variable represented as octal number</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_umask_for_daemons_as_number"/>
                  <description>Value of 'var_umask_for_daemons' variable represented as octal number</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_removable_partition' variable is set to '/dev/cdrom'</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_removable_partition_is_cd_dvd_drive"/>
                  <description>Verify if value of 'var_removable_partition' variable is set
      to '/dev/cdrom'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" comment="Check if removable partition value represents CD/DVD drive"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" class="compliance">
                <metadata>
                  <title>Value of 'var_accounts_user_umask' variable represented as octal number</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="var_accounts_user_umask_as_number"/>
                  <description>Value of 'var_accounts_user_umask' variable represented as octal number</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-use_pam_wheel_for_su:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enforce usage of pam_wheel for su authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="use_pam_wheel_for_su"/>
                  <description>Only members of the wheel group should be able to authenticate through the su command.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check that file storing USBGuard rules exists and is not empty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_rules_not_empty_not_missing"/>
                  <description>Check that file storing USBGuard rules at /etc/usbguard/rules.conf exists and is not empty</description>
                </metadata>
                <criteria comment="Check that file storing USBGuard rules exists and is not empty">
                  <criterion test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1" comment="Check that the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non white space character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hub:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize USB hubs in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hub"/>
                  <description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hid_and_hub:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize Human Interface Devices and USB hubs in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hid_and_hub"/>
                  <description>Check that /etc/usbguard/rules.conf contains at least one non whitespace character and exists.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-usbguard_allow_hid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Authorize Human Interface Devices in USBGuard daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="usbguard_allow_hid"/>
                  <description>Check that /etc/usbguard/rules.conf exists and that it contains at least one non white space character.</description>
                </metadata>
                <criteria comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character.">
                  <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" comment="Check that /etc/usbguard/rules.conf contains at least one non whitespace character."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-umask_for_daemons:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Daemon Umask</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="umask_for_daemons"/>
                  <description>The daemon umask should be set as appropriate</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-timer_dnf-automatic_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable dnf-automatic Timer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="timer_dnf-automatic_enabled"/>
                  <description>The dnf-automatic timer should be enabled if possible.</description>
                </metadata>
                <criteria comment="package dnf-automatic installed and timer dnf-automatic is configured to start">
                  <extend_definition definition_ref="oval:ssg-package_dnf-automatic_installed:def:1" comment="dnf-automatic installed"/>
                  <criteria comment="timer dnf-automatic is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1" comment="dnf-automatic is running"/>
                    <criterion test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" comment="multi-user.target wants dnf-automatic"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_x86_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for x86_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_x86_64"/>
                  <description>Generic test for x86_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1" comment="Generic test for x86_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_x86:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for x86 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_x86"/>
                  <description>Generic test for x86 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_x86:tst:1" comment="Generic test for x86 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_s390_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for s390_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_s390_64"/>
                  <description>Generic test for s390_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1" comment="Generic test for s390_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_ppc_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for PPC and PPCLE Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_ppc_64"/>
                  <description>Generic test for PPC PPC64LE architecture to be used by other tests</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1" comment="Generic test for ppc64 architecture"/>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" comment="Generic test for ppcle64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_aarch_64:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for aarch_64 Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_aarch_64"/>
                  <description>Generic test for aarch_64 architecture to be used by other tests</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1" comment="Generic test for aarch_64 architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_info_architecture_64bit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Test for 64-bit Architecture</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="system_info_architecture_64bit"/>
                  <description>Generic test for 64-bit architectures to be used by other tests</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_x86_64:def:1" comment="Generic test for x86_64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1" comment="Generic test for ppc64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1" comment="Generic test for aarch64 architecture"/>
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_s390_64:def:1" comment="Generic test for s390x architecture"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:uefi"/>
                  <reference source="ssg" ref_id="system_boot_mode_is_uefi"/>
                  <description>Check if system boot mode is UEFI.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>Non-UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:non-uefi"/>
                  <reference source="ssg" ref_id="system_boot_mode_is_non_uefi"/>
                  <description>Check if System boot mode is non-UEFI.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_vm_mmap_min_addr"/>
                  <description>The 'vm.mmap_min_addr' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" comment="vm.mmap_min_addr configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" comment="vm.mmap_min_addr runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_user_max_user_namespaces"/>
                  <description>The 'user.max_user_namespaces' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" comment="user.max_user_namespaces configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" comment="user.max_user_namespaces runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_vm_mmap_min_addr"/>
                  <description>The kernel 'vm.mmap_min_addr' parameter should be set to '65536'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" comment="kernel static parameter vm.mmap_min_addr set to 65536 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_user_max_user_namespaces"/>
                  <description>The kernel 'user.max_user_namespaces' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" comment="kernel static parameter user.max_user_namespaces set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_router_solicitations"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.default.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_max_addresses"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.default.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.default.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_autoconf"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.default.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_redirects"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_default_accept_ra"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel static parameter net.ipv6.conf.default.accept_ra set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_router_solicitations"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel static parameter net.ipv6.conf.all.router_solicitations set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_max_addresses"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel static parameter net.ipv6.conf.all.max_addresses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel static parameter net.ipv6.conf.all.disable_ipv6 set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_autoconf"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" comment="kernel static parameter net.ipv6.conf.all.autoconf set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel static parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_tcp_syncookies"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" comment="kernel static parameter net.ipv4.tcp_syncookies set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_ip_local_port_range"/>
                  <description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to '32768 65535'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" comment="kernel static parameter net.ipv4.ip_local_port_range set to 32768 65535 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_ip_forward"/>
                  <description>The kernel 'net.ipv4.ip_forward' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" comment="kernel static parameter net.ipv4.ip_forward set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel static parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel static parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_secure_redirects"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_rp_filter"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.default.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_log_martians"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.default.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_source_route"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_default_accept_redirects"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.default.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.send_redirects set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_secure_redirects"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.secure_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_rp_filter"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel static parameter net.ipv4.conf.all.rp_filter set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_log_martians"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" comment="kernel static parameter net.ipv4.conf.all.log_martians set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_source_route"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_source_route set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_ipv4_conf_all_accept_redirects"/>
                  <description> the appropriate value in the system configuration.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel static parameter net.ipv4.conf.all.accept_redirects set to the appropriate value in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_net_core_bpf_jit_harden"/>
                  <description>The kernel 'net.core.bpf_jit_harden' parameter should be set to '2'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" comment="kernel static parameter net.core.bpf_jit_harden set to 2 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_yama_ptrace_scope"/>
                  <description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" comment="kernel static parameter kernel.yama.ptrace_scope set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_unprivileged_bpf_disabled"/>
                  <description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel static parameter kernel.unprivileged_bpf_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_sysrq"/>
                  <description>The kernel 'kernel.sysrq' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" comment="kernel static parameter kernel.sysrq set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_randomize_va_space"/>
                  <description>The kernel 'kernel.randomize_va_space' parameter should be set to '2'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_pid_max"/>
                  <description>The kernel 'kernel.pid_max' parameter should be set to '65536'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_event_paranoid"/>
                  <description>The kernel 'kernel.perf_event_paranoid' parameter should be set to '2'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_event_max_sample_rate"/>
                  <description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_perf_cpu_time_max_percent"/>
                  <description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_modules_disabled"/>
                  <description>The kernel 'kernel.modules_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" comment="kernel static parameter kernel.modules_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_kptr_restrict"/>
                  <description>The kernel 'kernel.kptr_restrict' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_kexec_load_disabled"/>
                  <description>The kernel 'kernel.kexec_load_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" comment="kernel static parameter kernel.kexec_load_disabled set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_dmesg_restrict"/>
                  <description>The kernel 'kernel.dmesg_restrict' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_kernel_core_pattern"/>
                  <description>The kernel 'kernel.core_pattern' parameter should be set to '|/bin/false'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" comment="kernel static parameter kernel.core_pattern set to |/bin/false in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_suid_dumpable"/>
                  <description>The kernel 'fs.suid_dumpable' parameter should be set to '0'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_symlinks"/>
                  <description>The kernel 'fs.protected_symlinks' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_static_fs_protected_hardlinks"/>
                  <description>The kernel 'fs.protected_hardlinks' parameter should be set to '1'</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf"/>
                  <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf"/>
                  <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Prevent applications from mapping low portion of virtual memory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_vm_mmap_min_addr"/>
                  <description>The kernel 'vm.mmap_min_addr' parameter should be set to '65536'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" comment="kernel runtime parameter vm.mmap_min_addr set to 65536"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable the use of user namespaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_user_max_user_namespaces"/>
                  <description>The kernel 'user.max_user_namespaces' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" comment="kernel runtime parameter user.max_user_namespaces set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_router_solicitations"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_max_addresses"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_autoconf"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_redirects"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_default_accept_ra"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_router_solicitations"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_max_addresses"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_autoconf"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_tcp_syncookies"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_ip_local_port_range"/>
                  <description>The kernel 'net.ipv4.ip_local_port_range' parameter should be set to '32768 65535'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_ip_forward"/>
                  <description>The kernel 'net.ipv4.ip_forward' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" comment="kernel runtime parameter net.ipv4.ip_forward set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.default.send_redirects' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_secure_redirects"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_rp_filter"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_log_martians"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_source_route"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_default_accept_redirects"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_send_redirects"/>
                  <description>The kernel 'net.ipv4.conf.all.send_redirects' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_secure_redirects"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_rp_filter"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_log_martians"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_source_route"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_ipv4_conf_all_accept_redirects"/>
                  <description> the appropriate value in the system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_net_core_bpf_jit_harden"/>
                  <description>The kernel 'net.core.bpf_jit_harden' parameter should be set to '2'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_yama_ptrace_scope"/>
                  <description>The kernel 'kernel.yama.ptrace_scope' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_unprivileged_bpf_disabled"/>
                  <description>The kernel 'kernel.unprivileged_bpf_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_sysrq"/>
                  <description>The kernel 'kernel.sysrq' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" comment="kernel runtime parameter kernel.sysrq set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_randomize_va_space"/>
                  <description>The kernel 'kernel.randomize_va_space' parameter should be set to '2'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" comment="kernel runtime parameter kernel.randomize_va_space set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_pid_max"/>
                  <description>The kernel 'kernel.pid_max' parameter should be set to '65536'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" comment="kernel runtime parameter kernel.pid_max set to 65536"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_event_paranoid"/>
                  <description>The kernel 'kernel.perf_event_paranoid' parameter should be set to '2'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate"/>
                  <description>The kernel 'kernel.perf_event_max_sample_rate' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent"/>
                  <description>The kernel 'kernel.perf_cpu_time_max_percent' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_modules_disabled"/>
                  <description>The kernel 'kernel.modules_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" comment="kernel runtime parameter kernel.modules_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_kptr_restrict"/>
                  <description>The kernel 'kernel.kptr_restrict' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" comment="kernel runtime parameter kernel.kptr_restrict set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_kexec_load_disabled"/>
                  <description>The kernel 'kernel.kexec_load_disabled' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_dmesg_restrict"/>
                  <description>The kernel 'kernel.dmesg_restrict' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" comment="kernel runtime parameter kernel.dmesg_restrict set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_kernel_core_pattern"/>
                  <description>The kernel 'kernel.core_pattern' parameter should be set to '|/bin/false'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_suid_dumpable"/>
                  <description>The kernel 'fs.suid_dumpable' parameter should be set to '0'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" comment="kernel runtime parameter fs.suid_dumpable set to 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_symlinks"/>
                  <description>The kernel 'fs.protected_symlinks' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" comment="kernel runtime parameter fs.protected_symlinks set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_runtime_fs_protected_hardlinks"/>
                  <description>The kernel 'fs.protected_hardlinks' parameter should be set to '1'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" comment="kernel runtime parameter fs.protected_hardlinks set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.default.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.router_solicitations set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" comment="net.ipv6.conf.default.router_solicitations configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" comment="net.ipv6.conf.default.router_solicitations runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.default.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.max_addresses set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" comment="net.ipv6.conf.default.max_addresses configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" comment="net.ipv6.conf.default.max_addresses runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.default.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.disable_ipv6 set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" comment="net.ipv6.conf.default.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" comment="net.ipv6.conf.default.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.default.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.autoconf set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" comment="net.ipv6.conf.default.autoconf configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" comment="net.ipv6.conf.default.autoconf runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_redirects"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_redirects' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_redirects set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" comment="net.ipv6.conf.default.accept_redirects configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" comment="net.ipv6.conf.default.accept_redirects runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_rtr_pref set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.default.accept_ra_rtr_pref configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.default.accept_ra_rtr_pref runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_pinfo set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" comment="net.ipv6.conf.default.accept_ra_pinfo configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" comment="net.ipv6.conf.default.accept_ra_pinfo runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra_defrtr set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" comment="net.ipv6.conf.default.accept_ra_defrtr configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" comment="net.ipv6.conf.default.accept_ra_defrtr runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable Accepting Router Advertisements on all IPv6 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_default_accept_ra"/>
                  <description>The kernel 'net.ipv6.conf.default.accept_ra' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.default.accept_ra set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" comment="net.ipv6.conf.default.accept_ra configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" comment="net.ipv6.conf.default.accept_ra runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Denying Router Solicitations on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_router_solicitations"/>
                  <description>The kernel 'net.ipv6.conf.all.router_solicitations' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.router_solicitations set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" comment="net.ipv6.conf.all.router_solicitations configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" comment="net.ipv6.conf.all.router_solicitations runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_max_addresses"/>
                  <description>The kernel 'net.ipv6.conf.all.max_addresses' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.max_addresses set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" comment="net.ipv6.conf.all.max_addresses configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" comment="net.ipv6.conf.all.max_addresses runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" version="4" class="compliance">
                <metadata>
                  <title>Disable IPv6 Addressing on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_disable_ipv6"/>
                  <description>The kernel 'net.ipv6.conf.all.disable_ipv6' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Auto Configuration on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_autoconf"/>
                  <description>The kernel 'net.ipv6.conf.all.autoconf' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.autoconf set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" comment="net.ipv6.conf.all.autoconf configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" comment="net.ipv6.conf.all.autoconf runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_rtr_pref"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_rtr_pref' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_rtr_pref set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.all.accept_ra_rtr_pref configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" comment="net.ipv6.conf.all.accept_ra_rtr_pref runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_pinfo"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_pinfo' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_pinfo set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" comment="net.ipv6.conf.all.accept_ra_pinfo configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" comment="net.ipv6.conf.all.accept_ra_pinfo runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv6_conf_all_accept_ra_defrtr"/>
                  <description>The kernel 'net.ipv6.conf.all.accept_ra_defrtr' parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.accept_ra_defrtr set correctly">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="is IPv6 enabled?"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" comment="net.ipv6.conf.all.accept_ra_defrtr configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" comment="net.ipv6.conf.all.accept_ra_defrtr runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_tcp_syncookies"/>
                  <description>The 'net.ipv4.tcp_syncookies' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" comment="net.ipv4.tcp_syncookies configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" comment="net.ipv4.tcp_syncookies runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Kernel Parameter to Increase Local Port Range</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_ip_local_port_range"/>
                  <description>The 'net.ipv4.ip_local_port_range' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" comment="net.ipv4.ip_local_port_range configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" comment="net.ipv4.ip_local_port_range runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_ip_forward"/>
                  <description>The 'net.ipv4.ip_forward' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" comment="net.ipv4.ip_forward configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" comment="net.ipv4.ip_forward runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_ignore_bogus_error_responses"/>
                  <description>The 'net.ipv4.icmp_ignore_bogus_error_responses' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" comment="net.ipv4.icmp_ignore_bogus_error_responses configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" comment="net.ipv4.icmp_ignore_bogus_error_responses runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_icmp_echo_ignore_broadcasts"/>
                  <description>The 'net.ipv4.icmp_echo_ignore_broadcasts' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" comment="net.ipv4.icmp_echo_ignore_broadcasts configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" comment="net.ipv4.icmp_echo_ignore_broadcasts runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_send_redirects"/>
                  <description>The 'net.ipv4.conf.default.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" comment="net.ipv4.conf.default.send_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" comment="net.ipv4.conf.default.send_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_secure_redirects"/>
                  <description>The 'net.ipv4.conf.default.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" comment="net.ipv4.conf.default.secure_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" comment="net.ipv4.conf.default.secure_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_rp_filter"/>
                  <description>The 'net.ipv4.conf.default.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" comment="net.ipv4.conf.default.rp_filter configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" comment="net.ipv4.conf.default.rp_filter runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_log_martians"/>
                  <description>The 'net.ipv4.conf.default.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" comment="net.ipv4.conf.default.log_martians configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" comment="net.ipv4.conf.default.log_martians runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_source_route"/>
                  <description>The 'net.ipv4.conf.default.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" comment="net.ipv4.conf.default.accept_source_route configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" comment="net.ipv4.conf.default.accept_source_route runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_default_accept_redirects"/>
                  <description>The 'net.ipv4.conf.default.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" comment="net.ipv4.conf.default.accept_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" comment="net.ipv4.conf.default.accept_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_send_redirects"/>
                  <description>The 'net.ipv4.conf.all.send_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" comment="net.ipv4.conf.all.send_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" comment="net.ipv4.conf.all.send_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_secure_redirects"/>
                  <description>The 'net.ipv4.conf.all.secure_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" comment="net.ipv4.conf.all.secure_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" comment="net.ipv4.conf.all.secure_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_rp_filter"/>
                  <description>The 'net.ipv4.conf.all.rp_filter' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" comment="net.ipv4.conf.all.rp_filter configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" comment="net.ipv4.conf.all.rp_filter runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_log_martians"/>
                  <description>The 'net.ipv4.conf.all.log_martians' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" comment="net.ipv4.conf.all.log_martians configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" comment="net.ipv4.conf.all.log_martians runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_source_route"/>
                  <description>The 'net.ipv4.conf.all.accept_source_route' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" comment="net.ipv4.conf.all.accept_source_route configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" comment="net.ipv4.conf.all.accept_source_route runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Accepting ICMP Redirects for All IPv4 Interfaces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_ipv4_conf_all_accept_redirects"/>
                  <description>The 'net.ipv4.conf.all.accept_redirects' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" comment="net.ipv4.conf.all.accept_redirects configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" comment="net.ipv4.conf.all.accept_redirects runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden the operation of the BPF just-in-time compiler</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_net_core_bpf_jit_harden"/>
                  <description>The 'net.core.bpf_jit_harden' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" comment="net.core.bpf_jit_harden configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" comment="net.core.bpf_jit_harden runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict usage of ptrace to descendant processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_yama_ptrace_scope"/>
                  <description>The 'kernel.yama.ptrace_scope' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" comment="kernel.yama.ptrace_scope configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" comment="kernel.yama.ptrace_scope runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Access to Network bpf() Syscall From Unprivileged Processes</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_unprivileged_bpf_disabled"/>
                  <description>The 'kernel.unprivileged_bpf_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" comment="kernel.unprivileged_bpf_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" comment="kernel.unprivileged_bpf_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow magic SysRq key</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_sysrq"/>
                  <description>The 'kernel.sysrq' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1" comment="kernel.sysrq configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" comment="kernel.sysrq runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Randomized Layout of Virtual Address Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_randomize_va_space"/>
                  <description>The 'kernel.randomize_va_space' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" comment="kernel.randomize_va_space configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" comment="kernel.randomize_va_space runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure maximum number of process identifiers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_pid_max"/>
                  <description>The 'kernel.pid_max' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1" comment="kernel.pid_max configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" comment="kernel.pid_max runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disallow kernel profiling by unprivileged users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_event_paranoid"/>
                  <description>The 'kernel.perf_event_paranoid' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" comment="kernel.perf_event_paranoid configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" comment="kernel.perf_event_paranoid runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit sampling frequency of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_event_max_sample_rate"/>
                  <description>The 'kernel.perf_event_max_sample_rate' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" comment="kernel.perf_event_max_sample_rate configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" comment="kernel.perf_event_max_sample_rate runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3" class="compliance">
                <metadata>
                  <title>Limit CPU consumption of the Perf system</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_perf_cpu_time_max_percent"/>
                  <description>The 'kernel.perf_cpu_time_max_percent' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" comment="kernel.perf_cpu_time_max_percent configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" comment="kernel.perf_cpu_time_max_percent runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_modules_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable loading and unloading of kernel modules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_modules_disabled"/>
                  <description>The 'kernel.modules_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" comment="kernel.modules_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" comment="kernel.modules_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Exposed Kernel Pointer Addresses Access</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_kptr_restrict"/>
                  <description>The 'kernel.kptr_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" comment="kernel.kptr_restrict configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" comment="kernel.kptr_restrict runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Kernel Image Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_kexec_load_disabled"/>
                  <description>The 'kernel.kexec_load_disabled' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" comment="kernel.kexec_load_disabled configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" comment="kernel.kexec_load_disabled runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" class="compliance">
                <metadata>
                  <title>Kernel Runtime Parameter IPv6 Check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_ipv6_disable"/>
                  <description>Disables IPv6 for all network interfaces.</description>
                </metadata>
                <criteria operator="OR" comment="IPv6 disabled or net.ipv6.conf.all.disable_ipv6 set correctly">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 configuration setting check"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" comment="net.ipv6.conf.all.disable_ipv6 runtime setting check"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_exec_shield:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable ExecShield via sysctl</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_exec_shield"/>
                  <description>The kernel runtime parameter 'kernel.exec-shield' should not be disabled and set to 1 on 32-bit systems.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" comment="32-bit system"/>
                    <criterion test_ref="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" comment="kernel runtime parameter kernel.exec-shield set to 1"/>
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" comment="kernel /etc/sysctl.conf parameter kernel.exec-shield set to 1"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" comment="64-bit system"/>
                    <criterion test_ref="oval:ssg-test_nx_disabled_grub:tst:1" comment="NX is supported and is not disabled"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3" class="compliance">
                <metadata>
                  <title>Restrict Access to Kernel Message Buffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_dmesg_restrict"/>
                  <description>The 'kernel.dmesg_restrict' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" comment="kernel.dmesg_restrict configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" comment="kernel.dmesg_restrict runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_kernel_core_pattern:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable storing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_kernel_core_pattern"/>
                  <description>The 'kernel.core_pattern' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1" comment="kernel.core_pattern configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" comment="kernel.core_pattern runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for SUID programs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_suid_dumpable"/>
                  <description>The 'fs.suid_dumpable' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" comment="fs.suid_dumpable configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" comment="fs.suid_dumpable runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Symlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_symlinks"/>
                  <description>The 'fs.protected_symlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" comment="fs.protected_symlinks configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" comment="fs.protected_symlinks runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Kernel Parameter to Enforce DAC on Hardlinks</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_fs_protected_hardlinks"/>
                  <description>The 'fs.protected_hardlinks' kernel parameter should be set to the appropriate value in both system configuration and system runtime.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" comment="fs.protected_hardlinks configuration setting check"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" comment="fs.protected_hardlinks runtime setting check"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set kernel parameter 'crypto.fips_enabled' to 1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sysctl_crypto_fips_enabled"/>
                  <description>The kernel 'crypto.fips_enabled' parameter should be set to '1' in system runtime.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" comment="kernel runtime parameter crypto.fips_enabled set to 1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_validate_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure invoking users password for privilege escalation when using sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_validate_passwd"/>
                  <description>Ensure invoking user's password for privilege escalation when using sudo</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1" comment="Check Defaults !targetpw exists in /etc/sudoers file"/>
                  <criterion test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1" comment="Check Defaults !rootpw exists in /etc/sudoers file"/>
                  <criterion test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1" comment="Check Defaults !runaspw exists in /etc/sudoers file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_no_root_target:def:1" version="1" class="compliance">
                <metadata>
                  <title>Don't target root user in the sudoers file</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_no_root_target"/>
                  <description>Check that sudoers doesn't allow users to run commands as root</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL"/>
                  <criterion test_ref="oval:ssg-test_no_user_spec_rules:tst:1" comment="Make sure that all user specs in sudoers feature a runas spec"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_no_command_negation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Don't define allowed commands in sudoers by means of exclusion</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_no_command_negation"/>
                  <description>Check that sudoers doesn't contain command negations</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1" comment="Make sure that no command in user spec contains negation"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudoers_explicit_command_args:def:1" version="1" class="compliance">
                <metadata>
                  <title>Explicit arguments in sudo specifications</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudoers_explicit_command_args"/>
                  <description>Check that sudoers doesn't contain commands without arguments specified</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1" comment="Make sure that no commands are without arguments"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_vdsm_nopasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Only the VDSM User Can Use sudo NOPASSWD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_vdsm_nopasswd"/>
                  <description>Checks sudo usage for the vdsm user without a password</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" comment="NOPASSWD only exists for vdsm user in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_require_authentication:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_require_authentication"/>
                  <description>Checks sudo usage without password</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1"/>
                  <extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_remove_nopasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_remove_nopasswd"/>
                  <description>Checks sudo usage without password</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1" comment="NOPASSWD is not configured in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" comment="NOPASSWD is not configured in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_remove_no_authenticate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_remove_no_authenticate"/>
                  <description>Checks sudo usage without authentication</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" comment="!authenticate does not exist in /etc/sudoers"/>
                  <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" comment="!authenticate does not exist in /etc/sudoers.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_custom_logfile:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Sudo Logfile Exists - sudo logfile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_custom_logfile"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logfile_sudoers:tst:1" comment="logfile is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_use_pty:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_use_pty"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_use_pty_sudoers:tst:1" comment="use_pty is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_requiretty:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_requiretty"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_requiretty_sudoers:tst:1" comment="requiretty is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sudo_add_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sudo_add_noexec"/>
                  <description>Checks sudoers Defaults {{ OPTION }} configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_noexec_sudoers:tst:1" comment="noexec is configured in /etc/sudoers or /etc/sudoers.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to Expire SSH Known Hosts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_ssh_known_hosts_timeout"/>
                  <description>SSSD should be configured to expire keys from known SSH hosts after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_run_as_sssd_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to run as user sssd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_run_as_sssd_user"/>
                  <description>SSSD processes should be configured to run as user sssd, not root.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1" comment="Check user setting in SSSD configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_offline_cred_expiration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD to Expire Offline Credentials</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_offline_cred_expiration"/>
                  <description>SSSD should be configured to expire offline credentials after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1" comment="Check offline_credentials_expiration in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_memcache_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSSD's Memory Cache to Expire</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_memcache_timeout"/>
                  <description>SSSD's memory cache should be configured to set to expire records after 1 day.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1" comment="Check memcache_timeout in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_enable_smartcards:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Smartcards in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_enable_smartcards"/>
                  <description>SSSD should be configured to authenticate access to the system
    using smart cards.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" comment="Check if sssd service is disabled"/>
                    <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" negate="true" comment="Check if /etc/sssd/sssd.conf is configured for usage"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1" comment="Check pam_cert_auth in /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_enable_certmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Certmap in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_enable_certmap"/>
                  <description>Check presence of ^\[certmap\/.+\/.+\]$ in /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 0 extra definitions.">
                  <criterion test_ref="oval:ssg-test_sssd_enable_certmap:tst:1" comment="Check that /etc/sssd/sssd.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1" class="inventory">
                <metadata>
                  <title>SSSD is configured to use LDAP</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd-ldap"/>
                  <reference source="ssg" ref_id="sssd_conf_uses_ldap"/>
                  <description>Identification provider is not set to ad within /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true" comment="Identification provider is not set to ad within /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify The SSSD Configuration File Exists</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_conf_exists"/>
                  <description>The /etc/sssd/sssd.conf file should exist if it is
      in use.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_conf_exists:tst:1" comment="Check if sssd_conf_exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_certificate_verification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Certificate certificate status checking in SSSD</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sssd_certificate_verification"/>
                  <description>SSSD should be configured with the correct ocsp_dgst
            digest function</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sssd_certificate_verification:tst:1" comment="check value of certificate_verification in sssd configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_x11_use_localhost:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent remote hosts from connecting to the proxy display</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_x11_use_localhost"/>
                  <description>Ensure 'X11UseLocalhost' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1" comment="Check the X11UseLocalhost in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1" comment="Check the absence of X11UseLocalhost in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1" comment="Check the absence of X11UseLocalhost in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" comment="Check the X11UseLocalhost in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" class="compliance">
                <metadata>
                  <title>OpenSSH Server is 7.4 or newer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_version_equal_or_higher_than_74"/>
                  <description>Check if version of OpenSSH Server is equal or higher than 7.4</description>
                </metadata>
                <criteria operator="OR" comment="OpenSSH Server version is equal or higher than 7.4">
                  <criterion test_ref="oval:ssg-test_openssh-server_version:tst:1" comment="Check if OpenSSH Server is equal or higher than 7.4"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_use_priv_separation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Use of Privilege Separation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_use_priv_separation"/>
                  <description>Ensure 'UsePrivilegeSeparation' is configured with value 'sandbox' in '/etc/ssh/sshd_config'</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1" comment="Check the UsePrivilegeSeparation in /etc/ssh/sshd_config"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_use_directory_configuration:def:1" version="1" class="compliance">
                <metadata>
                  <title>Distribute the SSH Server configuration to multiple files in a config directory.</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_use_directory_configuration"/>
                  <description>foo</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria comment="sshd is configured correctly">
                      <extend_definition definition_ref="oval:ssg-sshd_includes_config_files:def:1" comment="sshd includes config files from its .d directory"/>
                      <criterion test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" comment="Check the absence of match in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_maxstartups:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SSH MaxStartups is configured</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_maxstartups"/>
                  <description>Ensure 'MaxStartups' is configured in
      '/etc/ssh/sshd_config'</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" comment="SSH MaxStartups start parameter is less than or equal to 10"/>
                    <criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" comment="SSH MaxStartups rate parameter is greater than or equal to 30"/>
                    <criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" comment="SSH MaxStartups full parameter is less than or equal to 100"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_max_sessions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH MaxSessions limit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_max_sessions"/>
                  <description>The SSH number of max sessions should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_max_sessions:tst:1" comment="Check MaxSessions in /etc/ssh/sshd_config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_max_auth_tries:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH authentication attempt limit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_max_auth_tries"/>
                  <description>The SSH MaxAuthTries should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-service_sshd_disabled:def:1" comment="sshd service is disabled"/>
                  <criterion test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1" comment="Check MaxAuthTries in /etc/ssh/sshd_config"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_loglevel_verbose:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Daemon LogLevel to VERBOSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_loglevel_verbose"/>
                  <description>Ensure 'LogLevel' is configured with value 'VERBOSE' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1" comment="Check the absence of LogLevel in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1" comment="Check the absence of LogLevel in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_loglevel_info:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set LogLevel to INFO</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_loglevel_info"/>
                  <description>Ensure 'LogLevel' is configured with value 'INFO' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1" comment="Check the absence of LogLevel in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1" comment="Check the absence of LogLevel in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" comment="Check the LogLevel in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_keepalive_0:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Client Alive Count Max to zero</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_keepalive_0"/>
                  <description>Ensure 'ClientAliveCountMax' is configured with value '0' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1" comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" comment="Check the ClientAliveCountMax in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_keepalive:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Client Alive Count Max</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_keepalive"/>
                  <description>The SSH ClientAliveCountMax should be set to an appropriate
      value (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1" comment="Check ClientAliveCountMax in /etc/ssh/sshd_config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_set_idle_timeout:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set SSH Idle Timeout Interval</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_set_idle_timeout"/>
                  <description>The SSH idle timeout interval should be set to an
      appropriate value.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_idle_timeout:tst:1" comment="Check ClientAliveInterval in /etc/ssh/sshd_config"/>
                    <extend_definition definition_ref="oval:ssg-sshd_set_keepalive:def:1" comment="The SSH ClientAliveCountMax is set to zero"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_requirement_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>It doesn't matter if sshd is installed or not</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_requirement_unset"/>
                  <description>Test if value sshd_required is 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_required_or_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>SSHD is required to be installed or requirement not set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_required_or_unset"/>
                  <description>If SSHD is required, we check it is installed. If SSH requirement is unset, we are good.</description>
                </metadata>
                <criteria operator="OR" comment="SSH required or not set">
                  <criterion test_ref="oval:ssg-test_sshd_required:tst:1"/>
                  <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" comment="SSH requirement is unset"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_rekey_limit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Force frequent session key renegotiation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_rekey_limit"/>
                  <description>Ensure 'RekeyLimit' is configured with the correct value in '/etc/ssh/sshd_config'</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_rekey_limit:tst:1" comment="Check the RekeyLimit in /etc/ssh/sshd_config"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_print_last_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SSH Print Last Log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_print_last_log"/>
                  <description>Ensure 'PrintLastLog' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_print_last_log:tst:1" comment="Check the PrintLastLog in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1" comment="Check the absence of PrintLastLog in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1" comment="Check the absence of PrintLastLog in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" comment="Check the PrintLastLog in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_not_required_or_unset:def:1" version="1" class="compliance">
                <metadata>
                  <title>SSHD is not required to be installed or requirement not set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_not_required_or_unset"/>
                  <description>If SSHD is not required, we check it is not installed. If SSH requirement is unset, we are good.</description>
                </metadata>
                <criteria operator="OR" comment="SSH not required or not set">
                  <criterion test_ref="oval:ssg-test_sshd_not_required:tst:1"/>
                  <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" comment="SSH requirement is unset"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_includes_config_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>sshd_includes_config_files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_includes_config_files"/>
                  <description>Check presence of Include /etc/ssh/sshd_config.d/*.conf in /etc/ssh/sshd_config</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 0 extra definitions.">
                  <criterion test_ref="oval:ssg-test_sshd_includes_config_files:tst:1" comment="Check that /etc/ssh/sshd_config contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_x11_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Encrypted X11 Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_x11_forwarding"/>
                  <description>Ensure 'X11Forwarding' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_warning_banner:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable SSH Warning Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_warning_banner"/>
                  <description>Ensure 'Banner' is configured with value '/etc/issue' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1" comment="Check the Banner in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" comment="Check the Banner in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_strictmodes:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Use of Strict Mode Checking</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_strictmodes"/>
                  <description>Ensure 'StrictModes' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1" comment="Check the StrictModes in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1" comment="Check the absence of StrictModes in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1" comment="Check the absence of StrictModes in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" comment="Check the StrictModes in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_enable_gssapi_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GSSAPI Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_enable_gssapi_auth"/>
                  <description>Ensure 'GSSAPIAuthentication' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_do_not_permit_user_env:def:1" version="1" class="compliance">
                <metadata>
                  <title>Do Not Allow SSH Environment Options</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_do_not_permit_user_env"/>
                  <description>Ensure 'PermitUserEnvironment' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1" comment="Check the absence of PermitUserEnvironment in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1" comment="Check the absence of PermitUserEnvironment in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" comment="Check the PermitUserEnvironment in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_x11_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable X11 Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_x11_forwarding"/>
                  <description>Ensure 'X11Forwarding' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1" comment="Check the absence of X11Forwarding in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1" comment="Check the absence of X11Forwarding in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" comment="Check the X11Forwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_user_known_hosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for User Known Hosts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_user_known_hosts"/>
                  <description>Ensure 'IgnoreUserKnownHosts' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" comment="Check the IgnoreUserKnownHosts in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_tcp_forwarding:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH TCP Forwarding</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_tcp_forwarding"/>
                  <description>Ensure 'AllowTcpForwarding' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" comment="Check the AllowTcpForwarding in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_root_password_login:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH root Login with a Password (Insecure)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_root_password_login"/>
                  <description>Ensure 'PermitRootLogin' is configured with value 'prohibit-password' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1" comment="Check the absence of PermitRootLogin in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1" comment="Check the absence of PermitRootLogin in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_root_login:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Root Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_root_login"/>
                  <description>Ensure 'PermitRootLogin' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_login:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" comment="Check the PermitRootLogin in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_rhosts_rsa:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for Rhosts RSA Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_rhosts_rsa"/>
                  <description>SSH can allow authentication through the obsolete rsh command
      through the use of the authenticating user's SSH keys. This should be disabled.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="SSH version is equal or higher than 7.4 has deprecated RhostsRSAAuthentication">
                      <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher has deprecated RhostsRSAAuthentication"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" negate="true" comment="Check RhostsRSAAuthentication in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_rhosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Support for .rhosts Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_rhosts"/>
                  <description>Ensure 'IgnoreRhosts' is configured with value 'yes' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1" comment="Check the IgnoreRhosts in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1" comment="Check the absence of IgnoreRhosts in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1" comment="Check the absence of IgnoreRhosts in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" comment="Check the IgnoreRhosts in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_pubkey_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable PubkeyAuthentication Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_pubkey_auth"/>
                  <description>Ensure 'PubkeyAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" comment="Check the PubkeyAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_kerb_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kerberos Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_kerb_auth"/>
                  <description>Ensure 'KerberosAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1" comment="Check the KerberosAuthentication in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1" comment="Check the absence of KerberosAuthentication in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1" comment="Check the absence of KerberosAuthentication in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" comment="Check the KerberosAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_gssapi_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GSSAPI Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_gssapi_auth"/>
                  <description>Ensure 'GSSAPIAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1" comment="Check the absence of GSSAPIAuthentication in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1" comment="Check the absence of GSSAPIAuthentication in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_empty_passwords:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Access via Empty Passwords</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_empty_passwords"/>
                  <description>Ensure 'PermitEmptyPasswords' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1" comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1" comment="Check the absence of PermitEmptyPasswords in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1" comment="Check the absence of PermitEmptyPasswords in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" comment="Check the PermitEmptyPasswords in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_disable_compression:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Compression Or Set Compression to delayed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_disable_compression"/>
                  <description>SSH should either have compression disabled or set to delayed.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criterion test_ref="oval:ssg-test_sshd_disable_compression:tst:1" comment="Check Compression in /etc/ssh/sshd_config"/>
                  </criteria>
                  <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher contains fix for authentication Compression exploit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sshd_allow_only_protocol2:def:1" version="1" class="compliance">
                <metadata>
                  <title>Allow Only SSH Protocol 2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="sshd_allow_only_protocol2"/>
                  <description>The OpenSSH daemon should be running protocol 2.</description>
                </metadata>
                <criteria operator="OR" comment="SSH is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="SSH version is equal or higher than 7.4 or it is configured with protocol 2">
                      <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" comment="OpenSSH version 7.4 or higher supports only protocol 2"/>
                      <criterion test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1" comment="Check Protocol in /etc/ssh/sshd_config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-snmpd_use_newer_protocol:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure SNMP Service to Use Only SNMPv3 or Newer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="snmpd_use_newer_protocol"/>
                  <description>SNMP version 1 and 2c must not be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_net-snmp_removed:def:1" comment="SNMP installed"/>
                  <criterion test_ref="oval:ssg-test_snmp_versions:tst:1" comment="SNMP protocols"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-snmpd_not_default_password:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure Default SNMP Password Is Not Used</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="snmpd_not_default_password"/>
                  <description>SNMP default communities must be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_snmp_default_communities:tst:1" comment="SNMP communities"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-smartcard_auth:def:1" version="3" class="compliance">
                <metadata>
                  <title>Enable Smart Card Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="smartcard_auth"/>
                  <description>Enable Smart Card logins</description>
                </metadata>
                <criteria comment="smart card authentication is configured">
                  <extend_definition definition_ref="oval:ssg-install_smartcard_packages:def:1" comment="packages needed for smartcard support are installed"/>
                  <extend_definition definition_ref="oval:ssg-service_pcscd_enabled:def:1" comment="pcscd service is enabled"/>
                  <criteria operator="OR">
                    <extend_definition definition_ref="oval:ssg-package_esc_installed:def:1" comment="esc package is installed"/>
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" comment="cert_policy directive contains oscp_on"/>
                  <criteria operator="OR" comment="smart card authentication is enabled or required in system-auth">
                    <criterion test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1" comment="smart card authentication is enabled in /etc/pam.d/system-auth"/>
                    <criterion test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1" comment="smart card is required in /etc/pam.d/system-auth"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" comment="smart card is required in /etc/pam.d/smartcard-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set PAM's Password Hashing Algorithm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_systemauth"/>
                  <description>The password hashing algorithm should be set correctly in /etc/pam.d/system-auth.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Password Hashing Algorithm in /etc/login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_logindefs"/>
                  <description>The password hashing algorithm should be set correctly in /etc/login.defs.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Password Hashing Algorithm in /etc/libuser.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_password_hashing_algorithm_libuserconf"/>
                  <description>The password hashing algorithm should be set correctly in /etc/libuser.conf.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-set_firewalld_default_zone:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Default firewalld Zone for Incoming Packets</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="set_firewalld_default_zone"/>
                  <description>Change the default firewalld zone to drop.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_firewalld_input_drop:tst:1" comment="Set default zone to drop"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_usbguard_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the USBGuard Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_usbguard_enabled"/>
                  <description>The usbguard service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package usbguard installed and service usbguard is configured to start">
                  <criterion test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" comment="usbguard installed"/>
                  <criteria comment="service usbguard is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_usbguard:tst:1" comment="usbguard is running"/>
                    <criteria operator="OR" comment="service usbguard is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1" comment="multi-user.target wants usbguard"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" comment="multi-user.target wants usbguard socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_systemd-coredump_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable acquiring, saving, and processing core dumps</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_systemd-coredump_disabled"/>
                  <description>The systemd-coredump service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package systemd removed or service systemd-coredump is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" comment="systemd removed"/>
                  <criteria comment="service systemd-coredump is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1" comment="systemd-coredump is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" comment="Property LoadState of service systemd-coredump is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_syslogng_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable syslog-ng Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_syslogng_enabled"/>
                  <description>The syslogng service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package syslogng installed and service syslogng is configured to start">
                  <criterion test_ref="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" comment="syslogng installed"/>
                  <criteria comment="service syslogng is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_syslogng:tst:1" comment="syslogng is running"/>
                    <criteria operator="OR" comment="service syslogng is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_syslogng:tst:1" comment="multi-user.target wants syslogng"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1" comment="multi-user.target wants syslogng socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_syslog_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>service_syslog_disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_syslog_disabled"/>
                  <description>The syslog service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package rsyslog removed or service syslog is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" comment="rsyslog removed"/>
                  <criteria comment="service syslog is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_syslog:tst:1" comment="syslog is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" comment="Property LoadState of service syslog is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_sssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>service_sssd_disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_sssd_disabled"/>
                  <description>The sssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package sssd-common removed or service sssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" comment="sssd-common removed"/>
                  <criteria comment="service sssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_sssd:tst:1" comment="sssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" comment="Property LoadState of service sssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_sshd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable SSH Server If Possible (Unusual)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_sshd_disabled"/>
                  <description>The sshd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package openssh-server removed or service sshd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" comment="openssh-server removed"/>
                  <criteria comment="service sshd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_sshd:tst:1" comment="sshd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" comment="Property LoadState of service sshd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rsyslog_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable rsyslog Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rsyslog_enabled"/>
                  <description>The rsyslog service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package rsyslog installed and service rsyslog is configured to start">
                  <criterion test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" comment="rsyslog installed"/>
                  <criteria comment="service rsyslog is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_rsyslog:tst:1" comment="rsyslog is running"/>
                    <criteria operator="OR" comment="service rsyslog is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1" comment="multi-user.target wants rsyslog"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" comment="multi-user.target wants rsyslog socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rsyncd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyncd service is diabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rsyncd_disabled"/>
                  <description>The rsyncd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package rsync-daemon removed or service rsyncd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" comment="rsync-daemon removed"/>
                  <criteria comment="service rsyncd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1" comment="rsyncd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" comment="Property LoadState of service rsyncd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcsvcgssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Secure RPC Server Service (rpcsvcgssd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcsvcgssd_disabled"/>
                  <description>The rpcsvcgssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcsvcgssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcsvcgssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" comment="rpcsvcgssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" comment="Property LoadState of service rpcsvcgssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcidmapd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable RPC ID Mapping Service (rpcidmapd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcidmapd_disabled"/>
                  <description>The rpcidmapd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcidmapd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcidmapd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1" comment="rpcidmapd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" comment="Property LoadState of service rpcidmapd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rpcgssd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Secure RPC Client Service (rpcgssd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rpcgssd_disabled"/>
                  <description>The rpcgssd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service rpcgssd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service rpcgssd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1" comment="rpcgssd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" comment="Property LoadState of service rpcgssd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_rngd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the Hardware RNG Entropy Gatherer Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_rngd_enabled"/>
                  <description>The rngd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package rng-tools installed and service rngd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" comment="rng-tools installed"/>
                  <criteria comment="service rngd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_rngd:tst:1" comment="rngd is running"/>
                    <criteria operator="OR" comment="service rngd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1" comment="multi-user.target wants rngd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" comment="multi-user.target wants rngd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_pcscd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the pcscd Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_pcscd_enabled"/>
                  <description>The pcscd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package pcsc-lite installed and service pcscd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" comment="pcsc-lite installed"/>
                  <criteria comment="service pcscd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_pcscd:tst:1" comment="pcscd is running"/>
                    <criteria operator="OR" comment="service pcscd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1" comment="multi-user.target wants pcscd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" comment="multi-user.target wants pcscd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ntpd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ntpd_enabled"/>
                  <description>The ntpd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package ntp installed and service ntpd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" comment="ntp installed"/>
                  <criteria comment="service ntpd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ntpd:tst:1" comment="ntpd is running"/>
                    <criteria operator="OR" comment="service ntpd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1" comment="multi-user.target wants ntpd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" comment="multi-user.target wants ntpd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ntp_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ntp_enabled"/>
                  <description>The ntp service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package ntp installed and service ntp is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" comment="ntp installed"/>
                  <criteria comment="service ntp is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ntp:tst:1" comment="ntp is running"/>
                    <criteria operator="OR" comment="service ntp is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1" comment="multi-user.target wants ntp"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" comment="multi-user.target wants ntp socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_nfslock_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File System Lock Service (nfslock)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_nfslock_disabled"/>
                  <description>The nfslock service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service nfslock is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service nfslock is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_nfslock:tst:1" comment="nfslock is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" comment="Property LoadState of service nfslock is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_nfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File System (nfs)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_nfs_disabled"/>
                  <description>The nfs-server service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package nfs-utils removed or service nfs-server is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" comment="nfs-utils removed"/>
                  <criteria comment="service nfs-server is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1" comment="nfs-server is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" comment="Property LoadState of service nfs-server is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_netfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Network File Systems (netfs)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_netfs_disabled"/>
                  <description>The netfs service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package netfs removed or service netfs is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" comment="netfs removed"/>
                  <criteria comment="service netfs is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_netfs:tst:1" comment="netfs is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" comment="Property LoadState of service netfs is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_iptables_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify iptables Enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_iptables_enabled"/>
                  <description>The iptables service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package iptables installed and service iptables is configured to start">
                  <criterion test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" comment="iptables installed"/>
                  <criteria comment="service iptables is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_iptables:tst:1" comment="iptables is running"/>
                    <criteria operator="OR" comment="service iptables is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1" comment="multi-user.target wants iptables"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" comment="multi-user.target wants iptables socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_ip6tables_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ip6tables Enabled if Using IPv6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_ip6tables_enabled"/>
                  <description>The ip6tables service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package iptables-ipv6 installed and service ip6tables is configured to start">
                  <criterion test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" comment="iptables-ipv6 installed"/>
                  <criteria comment="service ip6tables is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_ip6tables:tst:1" comment="ip6tables is running"/>
                    <criteria operator="OR" comment="service ip6tables is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1" comment="multi-user.target wants ip6tables"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" comment="multi-user.target wants ip6tables socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_firewalld_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify firewalld Enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_firewalld_enabled"/>
                  <description>The firewalld service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package firewalld installed and service firewalld is configured to start">
                  <criterion test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" comment="firewalld installed"/>
                  <criteria comment="service firewalld is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_firewalld:tst:1" comment="firewalld is running"/>
                    <criteria operator="OR" comment="service firewalld is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1" comment="multi-user.target wants firewalld"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" comment="multi-user.target wants firewalld socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_debug-shell_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable debug-shell SystemD Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_debug-shell_disabled"/>
                  <description>The debug-shell service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package systemd removed or service debug-shell is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" comment="systemd removed"/>
                  <criteria comment="service debug-shell is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1" comment="debug-shell is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" comment="Property LoadState of service debug-shell is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_crond_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable cron Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_crond_enabled"/>
                  <description>The crond service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package cronie installed and service crond is configured to start">
                  <criterion test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1" comment="cronie installed"/>
                  <criteria comment="service crond is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_crond:tst:1" comment="crond is running"/>
                    <criteria operator="OR" comment="service crond is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_crond:tst:1" comment="multi-user.target wants crond"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1" comment="multi-user.target wants crond socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_cron_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable cron Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_cron_enabled"/>
                  <description>The cron service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package cron installed and service cron is configured to start">
                  <criterion test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1" comment="cron installed"/>
                  <criteria comment="service cron is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_cron:tst:1" comment="cron is running"/>
                    <criteria operator="OR" comment="service cron is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_cron:tst:1" comment="multi-user.target wants cron"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1" comment="multi-user.target wants cron socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the NTP Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_chronyd_or_ntpd_enabled"/>
                  <description>At least one of the chronyd or ntpd services should be enabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="chronyd or ntpd service enabled">
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_chronyd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Chronyd service is enabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_chronyd_enabled"/>
                  <description>The chronyd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package chrony installed and service chronyd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" comment="chrony installed"/>
                  <criteria comment="service chronyd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_chronyd:tst:1" comment="chronyd is running"/>
                    <criteria operator="OR" comment="service chronyd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1" comment="multi-user.target wants chronyd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" comment="multi-user.target wants chronyd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_bluetooth_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Bluetooth Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_bluetooth_disabled"/>
                  <description>The bluetooth service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package bluez removed or service bluetooth is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" comment="bluez removed"/>
                  <criteria comment="service bluetooth is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1" comment="bluetooth is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" comment="Property LoadState of service bluetooth is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_autofs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the Automounter</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_autofs_disabled"/>
                  <description>The autofs service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package autofs removed or service autofs is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" comment="autofs removed"/>
                  <criteria comment="service autofs is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_autofs:tst:1" comment="autofs is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" comment="Property LoadState of service autofs is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_auditd_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable auditd Service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_auditd_enabled"/>
                  <description>The auditd service should be enabled if possible.</description>
                </metadata>
                <criteria comment="package audit installed and service auditd is configured to start">
                  <criterion test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1" comment="audit installed"/>
                  <criteria comment="service auditd is configured to start and is running">
                    <criterion test_ref="oval:ssg-test_service_running_auditd:tst:1" comment="auditd is running"/>
                    <criteria operator="OR" comment="service auditd is configured to start">
                      <criterion test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1" comment="multi-user.target wants auditd"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" comment="multi-user.target wants auditd socket"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-service_atd_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable At Service (atd)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="service_atd_disabled"/>
                  <description>The atd service should be disabled if possible.</description>
                </metadata>
                <criteria operator="OR" comment="package at removed or service atd is not configured to start">
                  <criterion test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1" comment="at removed"/>
                  <criteria comment="service atd is not configured to start">
                    <criterion test_ref="oval:ssg-test_service_not_running_atd:tst:1" comment="atd is not running"/>
                    <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" comment="Property LoadState of service atd is masked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_state:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SELinux State is Enforcing</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_state"/>
                  <description>The SELinux state should be enforcing the local policy.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_selinux_config:tst:1" comment="enforce is disabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_policytype:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SELinux Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_policytype"/>
                  <description>The SELinux policy should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_policy:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_confinement_of_daemons:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No Daemons are Unconfined by SELinux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_confinement_of_daemons"/>
                  <description>All pids in /proc should be assigned an SELinux security context other than 'unconfined_service_t'.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1" comment="no unconfined_service_t in /proc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-selinux_all_devicefiles_labeled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No Device Files are Unlabeled by SELinux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="selinux_all_devicefiles_labeled"/>
                  <description>All device files in /dev should be assigned an SELinux security context other than 'device_t' and 'unlabeled_t'.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_dev_device_t:tst:1" comment="device_t in /dev"/>
                  <criterion test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" comment="unlabeled_t in /dev"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-securetty_root_login_console_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Restrict Virtual Console Root Logins</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="securetty_root_login_console_only"/>
                  <description>Preventing direct root login to virtual console devices
      helps ensure accountability for actions taken on the system using the
      root account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" comment="virtual consoles /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_tls_cacert:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure CA certificate for rsyslog remote logging</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_tls_cacert"/>
                  <description>Check that the CA certificate path is set</description>
                </metadata>
                <criteria comment="Check that CA certificate is configured for rsyslog remote logging">
                  <criterion test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" comment="Check that the CA certificate path is set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_tls:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure TLS for rsyslog remote logging</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_tls"/>
                  <description>Check that all needed TLS-related options are present</description>
                </metadata>
                <criteria comment="Check that rsyslog is configured to use TLS for remote logging">
                  <criterion test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1" comment="Check that all needed TLS-related options are present"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_loghost:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Logs Sent To Remote Host</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_loghost"/>
                  <description>Syslog logs should be sent to a remote loghost</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1" comment="Remote logging set within /etc/rsyslog.conf"/>
                  <criterion test_ref="oval:ssg-test_remote_rsyslog_d:tst:1" comment="Remote logging set within /etc/rsyslog.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_remote_access_monitoring:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure remote access methods are monitored in Rsyslog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_remote_access_monitoring"/>
                  <description>Rsyslog should be configured to monitor remote access methods.</description>
                </metadata>
                <criteria comment="remote access methods are configured in rsyslog">
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1" comment="ensure 'auth.*' remote method is configured in rsyslog"/>
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" comment="ensure 'authpriv.*' remote method is configured in rsyslog"/>
                  <criterion test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1" comment="ensure 'daemon.*' remote method is configured in rsyslog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_nolisten:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_nolisten"/>
                  <description>rsyslogd should reject remote messages</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_nolisten:tst:1" comment="Conditions are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_permissions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure System Log Files Have Correct Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_permissions"/>
                  <description>File permissions for all syslog log files should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1" comment="Check permissions of all system log files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_ownership:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Log Files Are Owned By Appropriate User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_ownership"/>
                  <description>All syslog log files should be owned by the appropriate user.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1" comment="Check if all system log files are owned by appropriate user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_files_groupownership:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Log Files Are Owned By Appropriate Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_files_groupownership"/>
                  <description>All syslog log files should be owned by the appropriate group.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1" comment="Check if all system log files are owned by the appropriate group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_defaultnetstreamdriver"/>
                  <description>Rsyslogd must encrypt the off-loading of logs off of the system.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" comment="Check if $DefaultNetstreamDriver gtls is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Encrypts Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_actionsendstreamdrivermode"/>
                  <description>Rsyslogd must encrypt the off-loading of logs off of the system.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" comment="Check if $ActionSendStreamDriverMode 1 is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Rsyslog Authenticates Off-Loaded Audit Records</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_encrypt_offload_actionsendstreamdriverauthmode"/>
                  <description>Rsyslogd must authenticate remote system its sending logs to.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf"/>
                    <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in files in /etc/rsyslog.d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-rsyslog_cron_logging:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure cron Is Logging To Rsyslog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rsyslog_cron_logging"/>
                  <description>Rsyslog should be configured to capture cron messages.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1" comment="cron is configured in /etc/rsyslog.conf"/>
                  <criterion test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" comment="cron is configured in /etc/rsyslog.d"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rpm_verify_permissions:def:1" version="3" class="compliance">
                <metadata>
                  <title>Verify and Correct File Permissions with RPM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rpm_verify_permissions"/>
                  <description>Verify the permissions of installed packages
      by comparing the installed files with information about the
      files taken from the package metadata stored in the RPM
      database.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" comment="mode of all files matches local rpm database"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-rpm_verify_hashes:def:1" version="3" class="compliance">
                <metadata>
                  <title>Verify File Hashes with RPM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="rpm_verify_hashes"/>
                  <description>Verify the RPM digests of system binaries using the RPM database.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" comment="verify file md5 hashes"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-root_permissions_syslibrary_files:def:1" version="2" class="compliance">
                <metadata>
                  <title>Verify the system-wide library files in directories
"/lib", "/lib64", "/usr/lib/" and "/usr/lib64" are owned by root.</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="root_permissions_syslibrary_files"/>
                  <description>
        Checks that system-wide library files in /lib, /lib64, /usr/lib, /usr/lib64
        are owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-root_path_no_dot:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that Root's Path Does Not Include Relative Paths or Null Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="root_path_no_dot"/>
                  <description>The environment variable PATH should be set correctly for
      the root user.</description>
                </metadata>
                <criteria comment="environment variable PATH contains dangerous path">
                  <criterion test_ref="oval:ssg-test_env_var_begins:tst:1" comment="environment variable PATH starts with : or ."/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1" comment="environment variable PATH contains : twice in a row"/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1" comment="environment variable PATH contains . twice in a row"/>
                  <criterion test_ref="oval:ssg-test_env_var_ends:tst:1" comment="environment variable PATH ends with : or ."/>
                  <criterion test_ref="oval:ssg-test_env_var_begins_slash:tst:1" comment="environment variable PATH doesn't begin with a /"/>
                  <criterion test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1" comment="environment variable PATH doesn't contain relative paths"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-restrict_serial_port_logins:def:1" version="1" class="compliance">
                <metadata>
                  <title>Restrict Serial Port Root Logins</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="restrict_serial_port_logins"/>
                  <description>Preventing direct root login to serial port interfaces helps
      ensure accountability for actions taken on the system using the root
      account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" negate="true" comment="serial ports /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-require_singleuser_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Authentication for Single User Mode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="require_singleuser_auth"/>
                  <description>The requirement for a password to boot into single-user mode
      should be configured correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_require_rescue_service:tst:1" comment="Conditions are satisfied"/>
                  <criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1"/>
                  <criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-require_emergency_target_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Authentication for Emergency Systemd Target</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="require_emergency_target_auth"/>
                  <description>The requirement for a password to boot into emergency mode
      should be configured correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_require_emergency_service:tst:1" comment="Conditions are satisfied"/>
                  <criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1"/>
                  <criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" class="compliance">
                <metadata>
                  <title>Device Files for Removable Media Partitions Does Not Exist on the System</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="removable_partition_doesnt_exist"/>
                  <description>Verify if device file representing removable partitions
      exist on the system</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" comment="Check if removable partition really exists on the system"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_s390x"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" comment="Architecture is s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="proc_sys_kernel_osrelease_arch_not_s390x"/>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true" comment="Architecture is not s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-prefer_64bit_os:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prefer to use a 64-bit Operating System when supported</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="prefer_64bit_os"/>
                  <description>Check if the system supports a 64-bit Operating System</description>
                </metadata>
                <criteria operator="OR" comment="Either the OS is 64-bit, or the CPU doesn't support 64-bit (it is 32 or 16 bit)">
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" comment="Check if OS is 64-bit"/>
                  <criterion test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" negate="true" comment="Check if CPU is not 64-bit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-postfix_client_configure_mail_alias:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure System to Forward All Mail For The Root Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="postfix_client_configure_mail_alias"/>
                  <description>Check if root has the correct mail alias.</description>
                </metadata>
                <criteria comment="Check if root has the correct mail alias.">
                  <criterion test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" comment="Check if root has the correct mail alias."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var/log/audit Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var_log_audit"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" comment="/var/log/audit on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var/log Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var_log"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_log_partition:tst:1" comment="/var/log on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_var:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /var Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_var"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testvar_partition:tst:1" comment="/var on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_usr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /usr Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_usr"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testusr_partition:tst:1" comment="/usr on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /tmp Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_tmp"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testtmp_partition:tst:1" comment="/tmp on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_srv:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /srv Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_srv"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testsrv_partition:tst:1" comment="/srv on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_opt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /opt Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_opt"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testopt_partition:tst:1" comment="/opt on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_home:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /home Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_home"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testhome_partition:tst:1" comment="/home on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-partition_for_boot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure /boot Located On Separate Partition</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="partition_for_boot"/>
                  <description>If stored locally, create a separate partition for
      . If  will be mounted from another
      system such as an NFS server, then creating a separate partition is not
      necessary at this time, and the mountpoint can instead be configured
      later.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-testboot_partition:tst:1" comment="/boot on own partition"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_xorg-x11-server-common_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the X Windows Package Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_xorg-x11-server-common_removed"/>
                  <description>The RPM package xorg-x11-server-common should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" comment="package xorg-x11-server-common is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vsftpd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall vsftpd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vsftpd_removed"/>
                  <description>The RPM package vsftpd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vsftpd_removed:tst:1" comment="package vsftpd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vsftpd_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install vsftpd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vsftpd_installed"/>
                  <description>The RPM package vsftpd should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vsftpd_installed:tst:1" comment="package vsftpd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_vim_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install vim Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_vim_installed"/>
                  <description>The RPM package vim-enhanced should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1" comment="package vim-enhanced is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_usbguard_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install usbguard Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_usbguard_installed"/>
                  <description>The RPM package usbguard should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_usbguard_installed:tst:1" comment="package usbguard is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tuned_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall tuned Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tuned_removed"/>
                  <description>The RPM package tuned should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tuned_removed:tst:1" comment="package tuned is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tmux_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the tmux Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tmux_installed"/>
                  <description>The RPM package tmux should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tmux_installed:tst:1" comment="package tmux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_telnetd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_telnetd_removed"/>
                  <description>The RPM package telnetd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_telnetd_removed:tst:1" comment="package telnetd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the ssl compliant telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_telnetd-ssl_removed"/>
                  <description>The RPM package telnetd-ssl should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1" comment="package telnetd-ssl is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_tar_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install tar Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_tar_installed"/>
                  <description>The RPM package tar should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_tar_installed:tst:1" comment="package tar is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_syslogng_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure syslog-ng is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_syslogng_installed"/>
                  <description>The RPM package syslogng should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_syslogng_installed:tst:1" comment="package syslogng is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sudo_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install sudo Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sudo_installed"/>
                  <description>The RPM package sudo should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sudo_installed:tst:1" comment="package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sssd-ipa_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install sssd-ipa Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sssd-ipa_installed"/>
                  <description>The RPM package sssd-ipa should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1" comment="package sssd-ipa is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot_removed"/>
                  <description>The RPM package setroubleshoot should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1" comment="package setroubleshoot is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot-server_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot-server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot-server_removed"/>
                  <description>The RPM package setroubleshoot-server should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" comment="package setroubleshoot-server is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall setroubleshoot-plugins Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_setroubleshoot-plugins_removed"/>
                  <description>The RPM package setroubleshoot-plugins should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" comment="package setroubleshoot-plugins is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_sendmail_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall Sendmail Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_sendmail_removed"/>
                  <description>The RPM package sendmail should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_sendmail_removed:tst:1" comment="package sendmail is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_screen_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the screen Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_screen_installed"/>
                  <description>The RPM package screen should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_screen_installed:tst:1" comment="package screen is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_scap-security-guide_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install scap-security-guide Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_scap-security-guide_installed"/>
                  <description>The RPM package scap-security-guide should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1" comment="package scap-security-guide is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_samba-common_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_samba-common_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_samba-common_removed"/>
                  <description>The RPM package samba-common should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_samba-common_removed:tst:1" comment="package samba-common is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rsyslog_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyslog is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rsyslog_installed"/>
                  <description>The RPM package rsyslog should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rsyslog_installed:tst:1" comment="package rsyslog is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rsyslog-gnutls_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure rsyslog-gnutls is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rsyslog-gnutls_installed"/>
                  <description>The RPM package rsyslog-gnutls should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" comment="package rsyslog-gnutls is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rng-tools_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install rng-tools Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rng-tools_installed"/>
                  <description>The RPM package rng-tools should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rng-tools_installed:tst:1" comment="package rng-tools is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_rear_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install rear Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_rear_installed"/>
                  <description>The RPM package rear should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_rear_installed:tst:1" comment="package rear is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_prelink_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_prelink_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_prelink_removed"/>
                  <description>The RPM package prelink should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_prelink_removed:tst:1" comment="package prelink is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_policycoreutils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install policycoreutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_policycoreutils_installed"/>
                  <description>The RPM package policycoreutils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1" comment="package policycoreutils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_pcsc-lite_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the pcsc-lite package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_pcsc-lite_installed"/>
                  <description>The RPM package pcsc-lite should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1" comment="package pcsc-lite is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_pam_ldap_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_pam_ldap_removed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_pam_ldap_removed"/>
                  <description>The RPM package pam_ldap should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1" comment="package pam_ldap is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openssh-server_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the OpenSSH Server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openssh-server_removed"/>
                  <description>The RPM package openssh-server should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssh-server_removed:tst:1" comment="package openssh-server is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openssh-server_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the OpenSSH Server Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openssh-server_installed"/>
                  <description>The RPM package openssh-server should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssh-server_installed:tst:1" comment="package openssh-server is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openscap-scanner_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install openscap-scanner Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openscap-scanner_installed"/>
                  <description>The RPM package openscap-scanner should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1" comment="package openscap-scanner is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_opensc_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the opensc Package For Multifactor Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_opensc_installed"/>
                  <description>The RPM package opensc should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_opensc_installed:tst:1" comment="package opensc is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_openldap-clients_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure LDAP client is not installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_openldap-clients_removed"/>
                  <description>The RPM package openldap-clients should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1" comment="package openldap-clients is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_ntpdate_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the ntpdate package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_ntpdate_removed"/>
                  <description>The RPM package ntpdate should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_ntpdate_removed:tst:1" comment="package ntpdate is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_ntp_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the ntp service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_ntp_installed"/>
                  <description>The RPM package ntp should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_ntp_installed:tst:1" comment="package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nss-tools_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure nss-tools is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nss-tools_installed"/>
                  <description>The RPM package nss-tools should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nss-tools_installed:tst:1" comment="package nss-tools is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nis_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the nis package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nis_removed"/>
                  <description>The RPM package nis should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nis_removed:tst:1" comment="package nis is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_nfs-utils_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall nfs-utils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_nfs-utils_removed"/>
                  <description>The RPM package nfs-utils should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1" comment="package nfs-utils is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_net-snmp_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall net-snmp Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_net-snmp_removed"/>
                  <description>The RPM package net-snmp should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_net-snmp_removed:tst:1" comment="package net-snmp is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_mcstrans_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall mcstrans Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_mcstrans_removed"/>
                  <description>The RPM package mcstrans should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_mcstrans_removed:tst:1" comment="package mcstrans is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libselinux_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libselinux Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libselinux_installed"/>
                  <description>The RPM package libselinux should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libselinux_installed:tst:1" comment="package libselinux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libreswan_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libreswan Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libreswan_installed"/>
                  <description>The RPM package libreswan should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libreswan_installed:tst:1" comment="package libreswan is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_libcap-ng-utils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install libcap-ng-utils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_libcap-ng-utils_installed"/>
                  <description>The RPM package libcap-ng-utils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" comment="package libcap-ng-utils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_krb5-workstation_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall krb5-workstation Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_krb5-workstation_removed"/>
                  <description>The RPM package krb5-workstation should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1" comment="package krb5-workstation is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_iptables_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install iptables Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_iptables_installed"/>
                  <description>The RPM package iptables should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_iptables_installed:tst:1" comment="package iptables is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_iprutils_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall iprutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_iprutils_removed"/>
                  <description>The RPM package iprutils should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_iprutils_removed:tst:1" comment="package iprutils is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall the inet-based telnet server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_inetutils-telnetd_removed"/>
                  <description>The RPM package inetutils-telnetd should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" comment="package inetutils-telnetd is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gssproxy_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall gssproxy Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gssproxy_removed"/>
                  <description>The RPM package gssproxy should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gssproxy_removed:tst:1" comment="package gssproxy is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gnutls-utils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gnutls-utils is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gnutls-utils_installed"/>
                  <description>The RPM package gnutls-utils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1" comment="package gnutls-utils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_geolite2-country_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall geolite2-country Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_geolite2-country_removed"/>
                  <description>The RPM package geolite2-country should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1" comment="package geolite2-country is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_geolite2-city_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall geolite2-city Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_geolite2-city_removed"/>
                  <description>The RPM package geolite2-city should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1" comment="package geolite2-city is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gdm_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove the GDM Package Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gdm_removed"/>
                  <description>The RPM package gdm should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gdm_removed:tst:1" comment="package gdm is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_gdm_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_gdm_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_gdm_installed"/>
                  <description>The RPM package gdm should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_gdm_installed:tst:1" comment="package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_fapolicyd_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install fapolicyd Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_fapolicyd_installed"/>
                  <description>The RPM package fapolicyd should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1" comment="package fapolicyd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_esc_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_esc_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_esc_installed"/>
                  <description>The RPM package esc should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_esc_installed:tst:1" comment="package esc is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_dnf-automatic_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install dnf-automatic Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_dnf-automatic_installed"/>
                  <description>The RPM package dnf-automatic should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1" comment="package dnf-automatic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_dconf_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_dconf_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_dconf_installed"/>
                  <description>The RPM package dconf should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_dconf_installed:tst:1" comment="package dconf is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_cryptsetup-luks_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install cryptsetup-luks Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_cryptsetup-luks_installed"/>
                  <description>The RPM package cryptsetup-luks should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" comment="package cryptsetup-luks is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_cron_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the cron service</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_cron_installed"/>
                  <description>The RPM package cron should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_cron_installed:tst:1" comment="package cron is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_chrony_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Chrony package is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_chrony_installed"/>
                  <description>The RPM package chrony should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_chrony_installed:tst:1" comment="package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_binutils_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install binutils Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_binutils_installed"/>
                  <description>The RPM package binutils should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_binutils_installed:tst:1" comment="package binutils is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_bind_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall bind Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_bind_removed"/>
                  <description>The RPM package bind should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_bind_removed:tst:1" comment="package bind is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_avahi_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_avahi_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_avahi_installed"/>
                  <description>The RPM package avahi should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_avahi_installed:tst:1" comment="package avahi is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audit_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the audit Subsystem is Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audit_installed"/>
                  <description>The RPM package audit should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audit_installed:tst:1" comment="package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audit-audispd-plugins_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the default plugins for the audit dispatcher are Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audit-audispd-plugins_installed"/>
                  <description>The RPM package audit-audispd-plugins should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" comment="package audit-audispd-plugins is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_audispd-plugins_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install audispd-plugins Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_audispd-plugins_installed"/>
                  <description>The RPM package audispd-plugins should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1" comment="package audispd-plugins is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_aide_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install AIDE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_aide_installed"/>
                  <description>The RPM package aide should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_aide_installed:tst:1" comment="package aide is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall Automatic Bug Reporting Tool (abrt)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt_removed"/>
                  <description>The RPM package abrt should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt_removed:tst:1" comment="package abrt is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-sosreport Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-sosreport_removed"/>
                  <description>The RPM package abrt-plugin-sosreport should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" comment="package abrt-plugin-sosreport is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-rhtsupport Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-rhtsupport_removed"/>
                  <description>The RPM package abrt-plugin-rhtsupport should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" comment="package abrt-plugin-rhtsupport is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-plugin-logger_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-plugin-logger Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-plugin-logger_removed"/>
                  <description>The RPM package abrt-plugin-logger should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" comment="package abrt-plugin-logger is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-cli_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-cli Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-cli_removed"/>
                  <description>The RPM package abrt-cli should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1" comment="package abrt-cli is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-addon-python_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-addon-python Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-addon-python_removed"/>
                  <description>The RPM package abrt-addon-python should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-addon-python_removed:tst:1" comment="package abrt-addon-python is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-addon-kerneloops Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-addon-kerneloops_removed"/>
                  <description>The RPM package abrt-addon-kerneloops should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" comment="package abrt-addon-kerneloops is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Uninstall abrt-addon-ccpp Package</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_abrt-addon-ccpp_removed"/>
                  <description>The RPM package abrt-addon-ccpp should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" comment="package abrt-addon-ccpp is removed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_MFEhiplsm_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_MFEhiplsm_installed"/>
                  <description>The RPM package MFEhiplsm should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1" comment="package MFEhiplsm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-package_GConf2_installed:def:1" version="1" class="compliance">
                <metadata>
                  <title>package_GConf2_installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="package_GConf2_installed"/>
                  <description>The RPM package GConf2 should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_GConf2_installed:tst:1" comment="package GConf2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_specify_remote_server:def:1" version="2" class="compliance">
                <metadata>
                  <title>Specify a Remote NTP Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_specify_remote_server"/>
                  <description>A remote ntpd NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
                </metadata>
                <criteria comment="ntp.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2" class="compliance">
                <metadata>
                  <title>Specify Additional Remote NTP Servers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_specify_multiple_servers"/>
                  <description>Multiple ntpd NTP Servers for time synchronization should be specified.</description>
                </metadata>
                <criteria comment="ntp.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_run_as_ntp_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure ntpd To Run As ntp User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_run_as_ntp_user"/>
                  <description>Ensure ntpd is configured to run correctly under the ntp user.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" comment="check /etc/sysconfig/ntpd is configured correctly"/>
                  <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" comment="check /usr/lib/systemd/system/ntpd.service is configured correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ntpd_configure_restrictions:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure server restrictions for ntpd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ntpd_configure_restrictions"/>
                  <description>Certain restrictions are imposed on ntp servers configured to be used by ntpd</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" comment="test ipv6 configuration"/>
                  <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" comment="test ipv4 configuration"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_tmux_in_shells:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent user from disabling the screen lock</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_tmux_in_shells"/>
                  <description>Check that tmux is not listed in /etc/shells</description>
                </metadata>
                <criteria comment="Check that tmux is not listed in /etc/shells">
                  <criterion test_ref="oval:ssg-test_no_tmux_in_shells:tst:1" comment="check that tmux is not listed in /etc/shells"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that System Accounts Do Not Run a Shell Upon Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_shelllogin_for_systemaccounts"/>
                  <description>The root account is the only system account that should have
      a login shell.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" comment="Test SYS_UID_MIN not defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" comment="Test SYS_UID_MAX not defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1" comment="Test shell defined for UID from &lt;0, UID_MIN -1&gt;"/>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" negate="true" comment="Test SYS_UID_MIN defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" negate="true" comment="Test SYS_UID_MAX defined in /etc/login.defs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" comment="Test shell defined for reserved system UIDs"/>
                    <criterion test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" comment="Test shell defined for dynamically allocated system UIDs"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_rsh_trust_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>Remove Rsh Trust Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_rsh_trust_files"/>
                  <description>There should not be any .rhosts or hosts.equiv files on the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" negate="true"/>
                  <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_netrc_files:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify No netrc Files Exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_netrc_files"/>
                  <description>The .netrc files contain login information used to auto-login into FTP servers and reside in the user's home directory. Any .netrc files should be removed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" negate="true"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_shadow"/>
                  <description>No lines starting with + are in /etc/shadow</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/shadow">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_passwd"/>
                  <description>No lines starting with + are in /etc/passwd</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure there are no legacy + NIS entries in /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_legacy_plus_entries_etc_group"/>
                  <description>No lines starting with + are in /etc/group</description>
                </metadata>
                <criteria comment="no lines starting with + are in /etc/group">
                  <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_insecure_locks_exports:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Insecure File Locking is Not Allowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_insecure_locks_exports"/>
                  <description>Allowing insecure file locking could allow for sensitive 
      data to be viewed or edited by an unauthorized user.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1" comment="Check for insecure NFS locks in /etc/exports"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_files_unowned_by_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Files Are Owned by a User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_files_unowned_by_user"/>
                  <description>All files should be owned by a user</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1" comment="Check all files and make sure they are owned by a user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_empty_passwords:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent Login to Accounts With Empty Password</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_empty_passwords"/>
                  <description>The file /etc/pam.d/system-auth should not contain the nullok option</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_empty_passwords:tst:1" comment="make sure the nullok option is not used in /etc/pam.d/system-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_direct_root_logins:def:1" version="1" class="compliance">
                <metadata>
                  <title>Direct root Logins Not Allowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_direct_root_logins"/>
                  <description>Preventing direct root logins help ensure accountability for actions
      taken on the system using the root account.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_direct_root_logins:tst:1" comment="serial ports /etc/securetty"/>
                  <criterion test_ref="oval:ssg-test_etc_securetty_exists:tst:1" comment="serial ports /etc/securetty"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" class="compliance">
                <metadata>
                  <title>No CD/DVD drive is configured to automount in /etc/fstab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="no_cd_dvd_drive_in_etc_fstab"/>
                  <description>Check the /etc/fstab and check if a CD/DVD drive
      is not configured for automount.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" comment="Check if CD/DVD drive is not configured to automout in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_sniffer_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure System is Not Acting as a Network Sniffer</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_sniffer_disabled"/>
                  <description>Disable the network sniffer</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_promisc_interfaces:tst:1" negate="true" comment="promisc interfaces"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_nmcli_permissions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Prevent non-Privileged Users from Modifying Network Interfaces using nmcli</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_nmcli_permissions"/>
                  <description>polkit is properly configured to prevent non-privileged users from changing networking settings</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" comment="check for properly configured .pkla file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_static_address:def:1" version="1" class="compliance">
                <metadata>
                  <title>Manually Assign Global IPv6 Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_static_address"/>
                  <description>Manually configure addresses for IPv6</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_static_address:tst:1" comment="Set static IPv6 address on each interface"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_privacy_extensions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Use Privacy Extensions for Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_privacy_extensions"/>
                  <description>Enable privacy extensions for IPv6</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" comment="Enable privacy extensions per interface"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_disable_rpc:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Support for RPC IPv6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_disable_rpc"/>
                  <description>Disable ipv6 based rpc services</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" comment="Disable udp6"/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" comment="Disable tcp6"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_ipv6_default_gateway:def:1" version="1" class="compliance">
                <metadata>
                  <title>Manually Assign IPv6 Router Address</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_ipv6_default_gateway"/>
                  <description>Define default gateways for IPv6 traffic</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" comment="IPv6 disabled or..."/>
                  <criterion test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1" comment="Define default gateways"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-network_disable_zeroconf:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Zeroconf Networking</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="network_disable_zeroconf"/>
                  <description>Disable Zeroconf automatic route assignment in the
      169.254.0.0 subnet.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" comment="Look for NOZEROCONF=yes in /etc/sysconfig/network"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_tmp_bind:def:1" version="1" class="compliance">
                <metadata>
                  <title>Bind Mount /var/tmp To /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_tmp_bind"/>
                  <description>The /var/tmp directory should be bind mounted to /tmp in
      order to consolidate temporary storage into one location protected by the
      same techniques as /tmp.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" comment="Ensure /var/tmp is configured to bind mount to /tmp"/>
                  <criterion test_ref="oval:ssg-test_mount_option_var_tmp:tst:1" comment="Ensure /var/tmp is mounted"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1" comment="Ensure /var/tmp is mounted and binded"/>
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" comment="Ensure /var/tmp and /tmp have the same source device"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_nosuid"/>
                  <description>/var should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_noexec"/>
                  <description>/var should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" comment="noexec on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_nodev"/>
                  <description>/var should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" comment="nodev on /var"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_nosuid"/>
                  <description>/var/log should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_noexec"/>
                  <description>/var/log should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" comment="noexec on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var/log</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_nodev"/>
                  <description>/var/log should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" comment="nodev on /var/log"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_nosuid"/>
                  <description>/var/log/audit should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" comment="nosuid on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_noexec"/>
                  <description>/var/log/audit should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" comment="noexec on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_var_log_audit_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /var/log/audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_var_log_audit_nodev"/>
                  <description>/var/log/audit should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" comment="nodev on /var/log/audit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_nosuid"/>
                  <description>/tmp should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" comment="nosuid on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_noexec"/>
                  <description>/tmp should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" comment="noexec on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_tmp_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /tmp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_tmp_nodev"/>
                  <description>/tmp should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" comment="nodev on /tmp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_srv_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /srv</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_srv_nosuid"/>
                  <description>/srv should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" comment="nosuid on /srv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_opt_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /opt</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_opt_nosuid"/>
                  <description>/opt should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" comment="nosuid on /opt"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add nosuid Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nosuid_removable_partitions"/>
                  <description>The nosuid option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nosuid' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nosuid' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_noexec_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add noexec Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_noexec_removable_partitions"/>
                  <description>The noexec option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'noexec' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'noexec' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nodev_removable_partitions:def:1" version="5" class="compliance">
                <metadata>
                  <title>Add nodev Option to Removable Media Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nodev_removable_partitions"/>
                  <description>The nodev option should be enabled for all removable devices mounts in /etc/fstab.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" comment="Check if removable partition really exists on the system"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" comment="Check if removable partition value represents CD/DVD drive"/>
                    <criteria operator="OR">
                      <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" comment="Check if at least one from CD/DVD drive alternative names is using 'nodev' mount option in /etc/fstab"/>
                      <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" comment="Check if CD/DVD drive is not configured to automount in /etc/fstab"/>
                    </criteria>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" comment="Check if removable partition is using 'nodev' mount option in /etc/fstab"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to Non-Root Local Partitions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_nodev_nonroot_local_partitions"/>
                  <description>The nodev mount option prevents files from being interpreted
      as character or block devices. Legitimate character and block devices
      should exist in the /dev directory on the root partition or within chroot
      jails built for system services. All other locations should not allow
      character and block devices.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" negate="true" comment="nodev on local filesystems"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_home_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /home</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_home_noexec"/>
                  <description>/home should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" comment="noexec on /home"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_nosuid"/>
                  <description>/dev/shm should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" comment="nosuid on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_noexec"/>
                  <description>/dev/shm should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" comment="noexec on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_dev_shm_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /dev/shm</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_dev_shm_nodev"/>
                  <description>/dev/shm should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" comment="nodev on /dev/shm"/>
                  <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" negate="true" comment="/dev/shm does not exist"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_nosuid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nosuid Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_nosuid"/>
                  <description>/boot should be mounted with mount option nosuid.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" comment="nosuid on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_noexec:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noexec Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_noexec"/>
                  <description>/boot should be mounted with mount option noexec.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" comment="noexec on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_nodev:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add nodev Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_nodev"/>
                  <description>/boot should be mounted with mount option nodev.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" comment="nodev on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-mount_option_boot_noauto:def:1" version="1" class="compliance">
                <metadata>
                  <title>Add noauto Option to /boot</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="mount_option_boot_noauto"/>
                  <description>/boot should be mounted with mount option noauto.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" comment="noauto on /boot"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-logwatch_configured_splithosts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Logwatch SplitHosts Line</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="logwatch_configured_splithosts"/>
                  <description>Check if SplitHosts line in logwatch.conf is set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1" comment="Test value of SplitHosts"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-logwatch_configured_hostlimit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Logwatch HostLimit Line</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="logwatch_configured_hostlimit"/>
                  <description>Test if HostLimit line in logwatch.conf is set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1" comment="Test value of HostLimit"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_vfat_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of vFAT filesystems</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_vfat_disabled"/>
                  <description>The kernel module vfat should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" comment="kernel module vfat disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" comment="kernel module vfat disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" comment="kernel module vfat disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" comment="kernel module vfat disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" comment="kernel module vfat disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" comment="kernel module vfat disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" comment="kernel module vfat disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_usb-storage_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Modprobe Loading of USB Storage Driver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_usb-storage_disabled"/>
                  <description>The kernel module usb-storage should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" comment="kernel module usb-storage disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" comment="kernel module usb-storage disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" comment="kernel module usb-storage disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" comment="kernel module usb-storage disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_udf_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of udf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_udf_disabled"/>
                  <description>The kernel module udf should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" comment="kernel module udf disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" comment="kernel module udf disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" comment="kernel module udf disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" comment="kernel module udf disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" comment="kernel module udf disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" comment="kernel module udf disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" comment="kernel module udf disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_tipc_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable TIPC Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_tipc_disabled"/>
                  <description>The kernel module tipc should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" comment="kernel module tipc disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" comment="kernel module tipc disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" comment="kernel module tipc disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" comment="kernel module tipc disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" comment="kernel module tipc disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" comment="kernel module tipc disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" comment="kernel module tipc disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_squashfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of squashfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_squashfs_disabled"/>
                  <description>The kernel module squashfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" comment="kernel module squashfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" comment="kernel module squashfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" comment="kernel module squashfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" comment="kernel module squashfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_rds_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable RDS Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_rds_disabled"/>
                  <description>The kernel module rds should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" comment="kernel module rds disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" comment="kernel module rds disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" comment="kernel module rds disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" comment="kernel module rds disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" comment="kernel module rds disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" comment="kernel module rds disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" comment="kernel module rds disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_jffs2_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of jffs2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_jffs2_disabled"/>
                  <description>The kernel module jffs2 should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" comment="kernel module jffs2 disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" comment="kernel module jffs2 disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" comment="kernel module jffs2 disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" comment="kernel module jffs2 disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable IPv6 Networking Support Automatic Loading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_ipv6_option_disabled"/>
                  <description>The disable option will allow the IPv6 module to be inserted, but prevent address assignment and activation of the network stack.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" comment="ipv6 disabled any modprobe conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_hfsplus_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of hfsplus</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_hfsplus_disabled"/>
                  <description>The kernel module hfsplus should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" comment="kernel module hfsplus disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" comment="kernel module hfsplus disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" comment="kernel module hfsplus disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" comment="kernel module hfsplus disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_hfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of hfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_hfs_disabled"/>
                  <description>The kernel module hfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" comment="kernel module hfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" comment="kernel module hfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" comment="kernel module hfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" comment="kernel module hfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" comment="kernel module hfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" comment="kernel module hfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" comment="kernel module hfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_freevxfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of freevxfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_freevxfs_disabled"/>
                  <description>The kernel module freevxfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" comment="kernel module freevxfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" comment="kernel module freevxfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" comment="kernel module freevxfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" comment="kernel module freevxfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_firewire-core_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable IEEE 1394 (FireWire) Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_firewire-core_disabled"/>
                  <description>The kernel module firewire-core should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" comment="kernel module firewire-core disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" comment="kernel module firewire-core disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" comment="kernel module firewire-core disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" comment="kernel module firewire-core disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_dccp_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable DCCP Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_dccp_disabled"/>
                  <description>The kernel module dccp should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" comment="kernel module dccp disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" comment="kernel module dccp disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" comment="kernel module dccp disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" comment="kernel module dccp disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" comment="kernel module dccp disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" comment="kernel module dccp disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" comment="kernel module dccp disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_cramfs_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Mounting of cramfs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_cramfs_disabled"/>
                  <description>The kernel module cramfs should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" comment="kernel module cramfs disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" comment="kernel module cramfs disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" comment="kernel module cramfs disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" comment="kernel module cramfs disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_can_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable CAN Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_can_disabled"/>
                  <description>The kernel module can should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" comment="kernel module can disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" comment="kernel module can disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" comment="kernel module can disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" comment="kernel module can disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" comment="kernel module can disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" comment="kernel module can disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" comment="kernel module can disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_bluetooth_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Bluetooth Kernel Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_bluetooth_disabled"/>
                  <description>The kernel module bluetooth should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" comment="kernel module bluetooth disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" comment="kernel module bluetooth disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" comment="kernel module bluetooth disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" comment="kernel module bluetooth disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kernel_module_atm_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable ATM Support</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kernel_module_atm_disabled"/>
                  <description>The kernel module atm should be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" comment="kernel module atm disabled in /etc/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" comment="kernel module atm disabled in /etc/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" comment="kernel module atm disabled in /run/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" comment="kernel module atm disabled in /usr/lib/modules-load.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" comment="kernel module atm disabled in /run/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" comment="kernel module atm disabled in /usr/lib/modprobe.d"/>
                  <criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" comment="kernel module atm disabled in /etc/modprobe.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-kerberos_disable_no_keytab:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kerberos by removing host keytab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="kerberos_disable_no_keytab"/>
                  <description>Check that there is no Kerberos keytab file present in /etc</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" comment="Restrict Kerberos operation by removing keytab files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_machine:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a machine</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:machine"/>
                  <reference source="ssg" ref_id="installed_env_is_a_machine"/>
                  <description>Check for absence of files characterizing container filesystems.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true" comment="If environment is not a container, it is machine"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_container:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a container</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:container"/>
                  <reference source="ssg" ref_id="installed_env_is_a_container"/>
                  <description>Check for presence of files characterizing container filesystems.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" comment="Check if /.dockerenv exists"/>
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" comment="Check if /run/.containerenv exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_zipl_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>System uses zIPL</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:zipl"/>
                  <reference source="ssg" ref_id="installed_env_has_zipl_package"/>
                  <description>Checks if system uses zIPL bootloader.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" comment="Package s390utils-base is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_yum_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package yum is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:yum"/>
                  <reference source="ssg" ref_id="installed_env_has_yum_package"/>
                  <description>Checks if package yum is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" comment="Package yum is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_systemd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package systemd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:systemd"/>
                  <reference source="ssg" ref_id="installed_env_has_systemd_package"/>
                  <description>Checks if package systemd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" comment="Package systemd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sudo_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sudo is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sudo"/>
                  <reference source="ssg" ref_id="installed_env_has_sudo_package"/>
                  <description>Checks if package sudo is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" comment="Package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sssd-common is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd"/>
                  <reference source="ssg" ref_id="installed_env_has_sssd-common_package"/>
                  <description>Checks if package sssd-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" comment="Package sssd-common is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_postfix_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package postfix is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:postfix"/>
                  <reference source="ssg" ref_id="installed_env_has_postfix_package"/>
                  <description>Checks if package postfix is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" comment="Package postfix is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_pam_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package pam is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:pam"/>
                  <reference source="ssg" ref_id="installed_env_has_pam_package"/>
                  <description>Checks if package pam is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" comment="Package pam is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ntp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package ntp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ntp"/>
                  <reference source="ssg" ref_id="installed_env_has_ntp_package"/>
                  <description>Checks if package ntp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" comment="Package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package nss-pam-ldapd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:nss-pam-ldapd"/>
                  <reference source="ssg" ref_id="installed_env_has_nss-pam-ldapd_package"/>
                  <description>Checks if package nss-pam-ldapd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" comment="Package nss-pam-ldapd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package net-snmp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:net-snmp"/>
                  <reference source="ssg" ref_id="installed_env_has_net-snmp_package"/>
                  <description>Checks if package net-snmp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" comment="Package net-snmp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_login_defs:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package providing /etc/login.defs is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:login_defs"/>
                  <reference source="ssg" ref_id="installed_env_has_login_defs"/>
                  <description>Checks if package providing /etc/login.defs and is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" comment="Package providing /etc/login.defs is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_libuser_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package libuser is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:libuser"/>
                  <reference source="ssg" ref_id="installed_env_has_libuser_package"/>
                  <description>Checks if package libuser is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" comment="Package libuser is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_grub2_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package grub2 is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:grub2"/>
                  <reference source="ssg" ref_id="installed_env_has_grub2_package"/>
                  <description>Checks if package grub2-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" comment="Package grub2-common is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true" comment="Test for ppcle64 architecture"/>
                    <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true" comment="Test if OPAL is not used"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_gdm_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package gdm is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:gdm"/>
                  <reference source="ssg" ref_id="installed_env_has_gdm_package"/>
                  <description>Checks if package gdm is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" comment="Package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_chrony_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package chrony is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:chrony"/>
                  <reference source="ssg" ref_id="installed_env_has_chrony_package"/>
                  <description>Checks if package chrony is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" comment="Package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_audit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package audit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:audit"/>
                  <reference source="ssg" ref_id="installed_env_has_audit_package"/>
                  <description>Checks if package audit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" comment="Package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:virtualization:4"/>
                  <reference source="ssg" ref_id="installed_app_is_rhv4"/>
                  <description>The application installed installed on the system is
      Red Hat Virtualization 4.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" comment="Red Hat Virtualization Manager (RHVM)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhosp13:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat OpenStack Platform</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:openstack:13.0"/>
                  <reference source="ssg" ref_id="installed_app_is_rhosp13"/>
                  <description>The application installed installed on the system is
      Red Hat OpenStack Platform 13.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhosp13_release:tst:1" comment="OpenStack is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhosp10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat OpenStack Platform</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:openstack:10"/>
                  <reference source="ssg" ref_id="installed_app_is_rhosp10"/>
                  <description>The application installed installed on the system is
      Red Hat OpenStack Platform 10.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhosp10_release:tst:1" comment="OpenStack is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <reference source="ssg" ref_id="installed_OS_is_wrlinux8"/>
                  <description>The operating system installed on the system is
      Wind River Linux 8</description>
                </metadata>
                <criteria comment="current WRLinux version is WRLinux8">
                  <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" comment="WRLinux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 1019</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <reference source="ssg" ref_id="installed_OS_is_wrlinux1019"/>
                  <description>The operating system installed on the system is
      Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" comment="Produce name is WRLinux"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" comment="WRLinux version is 1019"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_vendor_supported:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Installed Operating System Is Vendor Supported</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_vendor_supported"/>
                  <description>
        The operating system installed on the system is supported by a vendor that provides security patches.
      </description>
                </metadata>
                <criteria operator="OR" comment="Installed operating system is supported by a vendor">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="Installed OS is RHEL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="Installed OS is RHEL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" comment="Installed OS is OL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1" comment="Installed OS is OL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" comment="Installed OS is SLE12"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" comment="Installed OS is SLE15"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu"/>
                  <description>The operating system installed is an Ubuntu System</description>
                </metadata>
                <criteria comment="System is Ubuntu">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_lsb:tst:1" comment="lsb-based distrib"/>
                  <criterion test_ref="oval:ssg-test_ubuntu:tst:1" comment="Ubuntu is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 2004</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:20.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu2004"/>
                  <description>The operating system installed on the system is Ubuntu 2004</description>
                </metadata>
                <criteria comment="current Ubuntu version is Focal">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" comment="Focal is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1804</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:18.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu1804"/>
                  <description>The operating system installed on the system is Ubuntu 1804</description>
                </metadata>
                <criteria comment="current Ubuntu version is Bionic">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" comment="Bionic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1604</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:16.04"/>
                  <reference source="ssg" ref_id="installed_OS_is_ubuntu1604"/>
                  <description>The operating system installed on the system is Ubuntu 1604</description>
                </metadata>
                <criteria comment="current Ubuntu version is Xenial">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" comment="Xenial is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle15:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:15"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:15"/>
                  <reference source="ssg" ref_id="installed_OS_is_sle15"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" comment="SLE 15 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle15_server:tst:1" comment="SLE 15 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" comment="SLES 15 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle12:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 12</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:12"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:12"/>
                  <reference source="ssg" ref_id="installed_OS_is_sle12"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" comment="SLE 12 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle12_server:tst:1" comment="SLE 12 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" comment="SLES 12 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl7:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_sl7"/>
                  <description>The operating system installed on the system is
      Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl7:tst:1" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl6:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <reference source="ssg" ref_id="installed_OS_is_sl6"/>
                  <description>The operating system installed on the system is
      Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl6:tst:1" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:virtualization:4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhv4"/>
                  <description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="RHEL8 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel9"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel9:tst:1" comment="RHEL 9 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 9"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.9"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_9"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" comment="RHEL 8.9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.8"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" comment="RHEL 8.8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.7"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" comment="RHEL 8.7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.6"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" comment="RHEL 8.6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.5</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.5"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" comment="RHEL 8.5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_4"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" comment="RHEL 8.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.3"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_3"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" comment="RHEL 8.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.2"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_2"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" comment="RHEL 8.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.1"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_1"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" comment="RHEL 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.10"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_10"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" comment="RHEL 8.10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.0"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8_0"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" comment="RHEL 8.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel8"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel8:tst:1" comment="RHEL 8 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 8"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhel7"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" comment="RHEL 7 Client is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" comment="RHEL 7 Workstation is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" comment="RHEL 7 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" comment="RHEL 7 Compute Node is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 7"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux CoreOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux_coreos:4"/>
                  <reference source="ssg" ref_id="installed_OS_is_rhcos4"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</description>
                </metadata>
                <criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_rhcos:tst:1" comment="RHCOS is installed"/>
                    <criterion test_ref="oval:ssg-test_rhcos4:tst:1" comment="RHCOS version 4 is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Installed operating system is part of the Unix family</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_part_of_Unix_family"/>
                  <description>The operating system installed on the system is part of the Unix OS family</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse_leap42"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" comment="openSUSE Leap 42 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse_leap15"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" comment="openSUSE Leap 15 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_opensuse"/>
                  <description>The operating system installed on the system is openSUSE.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_ol8_family"/>
                  <description>The operating system installed on the system is
      Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol8_system:tst:1" comment="Oracle Linux 8 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_ol7_family"/>
                  <description>The operating system installed on the system is
      Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol7_system:tst:1" comment="Oracle Linux 7 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_fedora:def:1" version="3" class="inventory">
                <metadata>
                  <title>Installed operating system is Fedora</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <reference source="ssg" ref_id="installed_OS_is_fedora"/>
                  <description>The operating system installed on the system is Fedora</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" comment="fedora-release RPM packages are installed"/>
                  <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" comment="CPE vendor is 'fedoraproject' and product is 'fedora'"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian:def:1" version="1" class="inventory">
                <metadata>
                  <title>Debian</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_debian"/>
                  <description>The operating system installed is a Debian System</description>
                </metadata>
                <criteria comment="System is Debian">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_debian:tst:1" comment="Debian is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian9:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:9"/>
                  <reference source="ssg" ref_id="installed_OS_is_debian9"/>
                  <description>The operating system installed on the system is Debian 9</description>
                </metadata>
                <criteria comment="current Debian version is Debian Stretch">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_9:tst:1" comment="Debian9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian10:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:10"/>
                  <reference source="ssg" ref_id="installed_OS_is_debian10"/>
                  <description>The operating system installed on the system is Debian 10</description>
                </metadata>
                <criteria comment="Debian Linux is version 10">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_10:tst:1" comment="Debian10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos8:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos8"/>
                  <description>The operating system installed on the system is
      CentOS 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos8_name:tst:1" comment="OS is CentOS"/>
                  <criterion test_ref="oval:ssg-test_centos8_version:tst:1" comment="OS version is 8"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos7:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos7"/>
                  <description>The operating system installed on the system is
      CentOS 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos7:tst:1" comment="CentOS7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos6:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <reference source="ssg" ref_id="installed_OS_is_centos6"/>
                  <description>The operating system installed on the system is
      CentOS 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos6:tst:1" comment="CentOS6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1" class="compliance">
                <metadata>
                  <title>The Installed Operating System Is FIPS 140-2 Certified</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="installed_OS_is_FIPS_certified"/>
                  <description>
          The operating system installed on the system is a certified operating system that meets FIPS 140-2 requirements.
      </description>
                </metadata>
                <criteria operator="OR" comment="Installed operating system is a certified operating system">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="Installed OS is RHEL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="Installed OS is RHEL8"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1" comment="Installed OS is RHCOS4"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" comment="Installed OS is OL7"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" comment="Installed OS is SLE12"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" comment="Installed OS is SLE15"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1" comment="Installed OS is Ubuntu 16.04"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1" comment="Installed OS is Ubuntu 18.04"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1" comment="Installed OS is Ubuntu 20.04"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_smartcard_packages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Smart Card Packages For Multifactor Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_smartcard_packages"/>
                  <description>The RPM package openssl-pkcs11 should be installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" comment="package openssl-pkcs11 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss_pa:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Policy Auditor (PA) Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss_pa"/>
                  <description>Install the Policy Auditor (PA) Module.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1" comment="McAfee Policy Auditor is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss_accm:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the Asset Configuration Compliance Module (ACCM)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss_accm"/>
                  <description>Install the Asset Configuration Compliance Module (ACCM).</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_accm_exists:tst:1" comment="McAfee ACCM is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_hbss:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_hbss"/>
                  <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
      should be installed.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1" comment="McAfee HBSS"/>
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1" comment="McAfee HBSS"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_cma_rt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install the McAfee Runtime Libraries and Linux Agent</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_cma_rt"/>
                  <description>Install the McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma).</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1" comment="McAfee runtime library package installed"/>
                  <criterion test_ref="oval:ssg-test_mcafee_management_agent:tst:1" comment="McAfee management agent package installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_mcafee_antivirus:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install McAfee Virus Scanning Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_mcafee_antivirus"/>
                  <description>McAfee Antivirus software should be installed.</description>
                </metadata>
                <criteria comment="Antivirus is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" comment="McAfee Runtime Libraries and Agent"/>
                  <criterion test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1" comment="Linuxshield AntiVirus package is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_hids:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Intrusion Detection Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_hids"/>
                  <description>Intrusion detection software or SELinux should be installed and enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_hbss:def:1" comment="McAfee HBSS"/>
                  <criterion test_ref="oval:ssg-test_selinux_enforcing:tst:1" comment="SELinux enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_antivirus:def:1" version="1" class="compliance">
                <metadata>
                  <title>Install Virus Scanning Software</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_antivirus"/>
                  <description>Antivirus software should be installed.</description>
                </metadata>
                <criteria comment="Antivirus is not being used or conditions are met">
                  <extend_definition definition_ref="oval:ssg-install_mcafee_antivirus:def:1" comment="McAfee A/V Installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" version="2" class="compliance">
                <metadata>
                  <title>Install PAE Kernel on Supported 32-bit x86 Systems</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="install_PAE_kernel_on_x86-32"/>
                  <description>The RPM package kernel-PAE should be installed on 32-bit
      systems.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" negate="true" comment="Not a 32-bit system"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" negate="true" comment="Check if PAE or NX is supported by the CPUs"/>
                    <criteria>
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" comment="A 32-bit system"/>
                      <criterion test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1" comment="Package kernel-PAE is installed"/>
                      <criterion test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_macs_openssh_conf_crypto_policy"/>
                  <description>Limit the Message Authentication Codes (MACs) to those which are FIPS-approved.</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus.">
                  <criterion test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD MACs"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Harden SSHD Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_crypto_policy"/>
                  <description>Ensure 'CRYPTO_POLICY' is configured with value ''-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'' in /etc/crypto-policies/back-ends/opensshserver.config</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1" comment="Check the CRYPTO_POLICY in /etc/crypto-policies/back-ends/opensshserver.config"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_sshd_ciphers_openssh_conf_crypto_policy"/>
                  <description>Limit the Ciphers to those which are FIPS-approved.</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus.">
                  <criterion test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/openssh.config contains FIPS-approved SSHD Ciphers"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-harden_ssh_client_crypto_policy:def:1" version="3" class="compliance">
                <metadata>
                  <title>Harden SSH client Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="harden_ssh_client_crypto_policy"/>
                  <description>Ensure the ssh client ciphers are configured correctly in /etc/ssh/ssh_config.d/02-ospp.conf</description>
                </metadata>
                <criteria comment="SSH client is configured correctly">
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" comment="Check the Match in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" comment="Check the RekeyLimit in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" comment="Check the GSSAPIAuthentication in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" comment="Check the Ciphers in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" comment="Check the PubkeyAcceptedKeyTypes in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" comment="Check the MACs in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                  <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" comment="Check the KexAlgorithms in /etc/ssh/ssh_config.d/02-ospp.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_vsyscall_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable vsyscalls</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_vsyscall_argument"/>
                  <description>Ensure vsyscall=none is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" comment="Check if vsyscall=none is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_uefi_password:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the UEFI Boot Loader Password</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_uefi_password"/>
                  <description>The UEFI grub2 boot loader should have password protection enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system"/>
                  <criteria>
                    <criteria operator="OR" comment="check both files to account for procedure change in documenation">
                      <criterion test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" comment="make sure a password is defined in /boot/grub2/user.cfg"/>
                      <criterion test_ref="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1" comment="make sure a password is defined in /boot/grub2/grub.cfg"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_bootloader_uefi_superuser:tst:1" comment="make sure a superuser is defined in /boot/grub2/grub.cfg"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_uefi_admin_username:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the UEFI Boot Loader Admin Username to a Non-Default Value</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_uefi_admin_username"/>
                  <description>The grub2 boot loader superuser should have a username that is hard to guess.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system"/>
                  <criterion test_ref="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1" comment="make sure a superuser is defined in /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_slub_debug_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable SLUB/SLAB allocator poisoning</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_slub_debug_argument"/>
                  <description>Ensure slub_debug=P is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" comment="Check if slub_debug=P is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_pti_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable Kernel Page-Table Isolation (KPTI)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_pti_argument"/>
                  <description>Ensure pti=on is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" comment="Check if pti=on is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_password:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Boot Loader Password in grub2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_password"/>
                  <description>The grub2 boot loader should have password protection enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system"/>
                  <criteria>
                    <criteria operator="OR" comment="check both files to account for procedure change in documenation">
                      <criterion test_ref="oval:ssg-test_grub2_password_usercfg:tst:1" comment="make sure a password is defined in /boot/grub2/user.cfg"/>
                      <criterion test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1" comment="make sure a password is defined in /boot/grub2/grub.cfg"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_bootloader_superuser:tst:1" comment="make sure a superuser is defined in /boot/grub2/grub.cfg"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_page_poison_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable page allocator poisoning</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_page_poison_argument"/>
                  <description>Ensure page_poison=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" comment="Check if page_poison=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_nousb_argument:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Kernel Support for USB via Bootloader Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_nousb_argument"/>
                  <description>Ensure 'GRUB_CMDLINE_LINUX' is configured with value 'nousb' in /etc/default/grub</description>
                </metadata>
                <criteria operator="OR" comment="grub is configured correctly">
                  <criterion test_ref="oval:ssg-test_grub2_nousb_argument:tst:1" comment="Check the GRUB_CMDLINE_LINUX in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_ipv6_disable_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure IPv6 is disabled through kernel boot parameter</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_ipv6_disable_argument"/>
                  <description>Ensure ipv6.disable=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" comment="Check if ipv6.disable=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_enable_selinux:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure SELinux Not Disabled in /etc/default/grub</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_enable_selinux"/>
                  <description>
        Check if selinux=0 OR enforcing=0 within the GRUB2 configuration files, fail if found.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_selinux_default_grub:tst:1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found"/>
                  <criterion test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found"/>
                  <criterion test_ref="oval:ssg-test_selinux_grub_dir:tst:1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_enable_iommu_force:def:1" version="2" class="compliance">
                <metadata>
                  <title>IOMMU configuration directive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_enable_iommu_force"/>
                  <description>Ensure iommu=force is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" comment="Check if iommu=force is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_disable_interactive_boot:def:1" version="4" class="compliance">
                <metadata>
                  <title>Verify that Interactive Boot is Disabled</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_disable_interactive_boot"/>
                  <description>The ability for users to perform interactive startups should
      be disabled.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT"/>
                    <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_default_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>GRUB_CMDLINE_LINUX_DEFAULT existance check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_default_exists"/>
                  <description>Check if GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Extend Audit Backlog Limit for the Audit Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_audit_backlog_limit_argument"/>
                  <description>Ensure audit_backlog_limit=8192 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" comment="Check if audit_backlog_limit=8192 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_audit_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_audit_argument"/>
                  <description>Ensure audit=1 is configured in the kernel line in /etc/default/grub.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" comment="Check if audit=1 is present in the GRUB2 environment variable block in /boot/grub2/grubenv"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-grub2_admin_username:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the Boot Loader Admin Username to a Non-Default Value</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="grub2_admin_username"/>
                  <description>The grub2 boot loader superuser should have a username that is hard to guess.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/grub2/grub.cfg' exist in the system"/>
                  <criterion test_ref="oval:ssg-test_bootloader_unique_superuser:tst:1" comment="Superuser is defined in /boot/grub2/grub.cfg and it isn't root, admin, or administrator."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable XDMCP in GDM</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_xdmcp"/>
                  <description>Ensure 'Enable' is configured with value 'false in section 'xdmcp' in /etc/gdm/custom.conf</description>
                </metadata>
                <criteria comment="gdm is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="gdm is configured correctly">
                    <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" comment="Check the Enable in /etc/gdm/custom.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" comment="test if configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_guest_login:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GDM Guest Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_guest_login"/>
                  <description>Disable the GNOME Display Manager (GDM) ability to allow guest users
      to login.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true" comment="gdm installed"/>
                  <criterion test_ref="oval:ssg-test_disable_guest_login:tst:1" comment="Disable GDM Guest Login"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GDM Automatic Login</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gnome_gdm_disable_automatic_login"/>
                  <description>Disable the GNOME Display Manager (GDM) ability to allow users to
      automatically login.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" negate="true" comment="gdm installed"/>
                  <criterion test_ref="oval:ssg-test_disable_automatic_login:tst:1" comment="Disable GDM Automatic Login"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-gid_passwd_group_same:def:1" version="2" class="compliance">
                <metadata>
                  <title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="gid_passwd_group_same"/>
                  <description>All GIDs referenced in /etc/passwd must be defined in /etc/group.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ftp_present_banner:def:1" version="1" class="compliance">
                <metadata>
                  <title>Create Warning Banners for All FTP Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ftp_present_banner"/>
                  <description>This setting will cause the system greeting banner to be 
      used for FTP connections as well.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_vsftpd_removed:def:1" comment="vsftpd package is not installed"/>
                  <criterion test_ref="oval:ssg-test_ftp_present_banner:tst:1" comment="Banner for FTP Users"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ftp_log_transactions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Logging of All FTP Transactions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ftp_log_transactions"/>
                  <description>To trace malicious activity facilitated by the FTP 
      service, it must be configured to ensure that all commands sent to 
      the FTP server are logged using the verbose vsftpd log format.
      </description>
                </metadata>
                <criteria operator="OR" comment="FTP is not being used or the conditions are met">
                  <extend_definition definition_ref="oval:ssg-package_vsftpd_installed:def:1" negate="true" comment="vsftp package is not installed"/>
                  <criteria comment="FTP configuration conditions are not set or are met">
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1" comment="log ftp transactions enable"/>
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1" comment="log ftp transactions format"/>
                    <criterion test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1" comment="log ftp transactions protocol"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-force_opensc_card_drivers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Force opensc To Use Defined Smart Card Driver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="force_opensc_card_drivers"/>
                  <description>Force opensc to use the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" comment="Check that force_card_driver is configured for opensc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log_messages"/>
                  <description>This test makes sure that /var/log/messages has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_messages:tst:1" negate="true" comment="Check file mode of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log_audit:def:1" version="2" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log_audit"/>
                  <description>Checks for correct permissions for all log files in /var/log/audit.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" negate="true"/>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" negate="true"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_var_log"/>
                  <description>This test makes sure that /var/log/ has mode 0755.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_var_log:tst:1" negate="true" comment="Check file mode of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_ungroupowned:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure All Files Are Owned by a Group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_ungroupowned"/>
                  <description>All files should be owned by a group</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1" comment="Check all files and make sure they are owned by a group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure No World-Writable Files Exist</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_world_writable"/>
                  <description>The world-write permission should be disabled for all files.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_suid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All SUID Executables Are Authorized</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_suid"/>
                  <description>Evaluates to true if all files with SUID set are owned by RPM packages.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" comment="Check all suid files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_unauthorized_sgid:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All SGID Executables Are Authorized</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_unauthorized_sgid"/>
                  <description>Evaluates to true if all files with SGID set are owned by RPM packages.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" comment="Check all sgid files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_systemmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that local System.map file (if exists) is readable only by root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_systemmap"/>
                  <description>
        Checks that /boot/System.map-* are only readable by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_sshd_pub_key:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on SSH Server Public *.pub Key Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_sshd_pub_key"/>
                  <description>This test makes sure that /etc/ssh/ has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" negate="true" comment="Check file mode of /etc/ssh/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_sshd_private_key:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on SSH Server Private *_key Key Files</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_sshd_private_key"/>
                  <description>This test makes sure that /etc/ssh/ has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_sshd_private_key:tst:1" negate="true" comment="Check file mode of /etc/ssh/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Files Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_library_dirs"/>
                  <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_perms_lib_dir:tst:1"/>
                  <criterion test_ref="oval:ssg-test_perms_lib_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_home_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_home_dirs"/>
                  <description>File permissions should be set correctly for the home directories for all user accounts.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" negate="true" comment="home directories"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_grub2_cfg"/>
                  <description>This test makes sure that /boot/grub2/grub.cfg has mode 0600.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_grub2_cfg:tst:1" negate="true" comment="Check file mode of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_shadow:tst:1" negate="true" comment="Check file mode of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_passwd:tst:1" negate="true" comment="Check file mode of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify permissions on Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_motd"/>
                  <description>This test makes sure that /etc/motd has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_motd:tst:1" negate="true" comment="Check file mode of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify permissions on System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_issue"/>
                  <description>This test makes sure that /etc/issue has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_issue:tst:1" negate="true" comment="Check file mode of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_gshadow:tst:1" negate="true" comment="Check file mode of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_group"/>
                  <description>This test makes sure that /etc/group has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_group:tst:1" negate="true" comment="Check file mode of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /etc/audit/rules.d/*.rules</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_audit_rulesd"/>
                  <description>This test makes sure that /etc/audit/rules.d/ has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" negate="true" comment="Check file mode of /etc/audit/rules.d/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_etc_audit_auditd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on /etc/audit/auditd.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_etc_audit_auditd"/>
                  <description>This test makes sure that /etc/audit/auditd.conf has mode 0640.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" negate="true" comment="Check file mode of /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_efi_grub2_cfg"/>
                  <description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg has mode 0700.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" negate="true" comment="Check file mode of /boot/efi/EFI/fedora/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_binary_dirs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Verify that System Executables Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_binary_dirs"/>
                  <description>
        Checks that binary files under /bin, /sbin, /usr/bin, /usr/sbin,
        /usr/local/bin, /usr/local/sbin, and /usr/libexec are not group-writable or world-writable.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" negate="true" comment="Check file mode of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" negate="true" comment="Check file mode of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow- has mode 0000.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" negate="true" comment="Check file mode of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_permissions_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Permissions on Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_permissions_backup_etc_group"/>
                  <description>This test makes sure that /etc/group- has mode 0644.
      If the target file or directory has an extended ACL, then it will fail the mode check.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_group:tst:1" negate="true" comment="Check file mode of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_var_log_audit:def:1" version="3" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Be Owned By Root</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_var_log_audit"/>
                  <description>Checks that all /var/log/audit files and directories are owned by the root user and group.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="directories are root owned">
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1"/>
                  </criteria>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1"/>
                    <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Files Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_library_dirs"/>
                  <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ownership_lib_dir:tst:1"/>
                  <criterion test_ref="oval:ssg-test_ownership_lib_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_ownership_binary_dirs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Verify that System Executables Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_ownership_binary_dirs"/>
                  <description>
        Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin,
        /usr/local/sbin, /usr/libexec, and objects therein, are owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1"/>
                  <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_var_log_messages"/>
                  <description>This test makes sure that /var/log/messages is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_var_log_messages:tst:1" comment="Check file ownership of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_var_log"/>
                  <description>This test makes sure that /var/log/ is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_var_log:tst:1" comment="Check file ownership of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg User Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_grub2_cfg"/>
                  <description>This test makes sure that /boot/grub2/grub.cfg is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_grub2_cfg:tst:1" comment="Check file ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_shadow:tst:1" comment="Check file ownership of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_passwd:tst:1" comment="Check file ownership of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ownership of Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_motd"/>
                  <description>This test makes sure that /etc/motd is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_motd:tst:1" comment="Check file ownership of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify ownership of System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_issue"/>
                  <description>This test makes sure that /etc/issue is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_issue:tst:1" comment="Check file ownership of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow:tst:1" comment="Check file ownership of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_etc_group"/>
                  <description>This test makes sure that /etc/group is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_etc_group:tst:1" comment="Check file ownership of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg User Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_efi_grub2_cfg"/>
                  <description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1" comment="Check file ownership of /boot/efi/EFI/fedora/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow- is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_shadow:tst:1" comment="Check file ownership of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd- is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_passwd:tst:1" comment="Check file ownership of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow- is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1" comment="Check file ownership of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_owner_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_owner_backup_etc_group"/>
                  <description>This test makes sure that /etc/group- is owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_owner_backup_etc_group:tst:1" comment="Check file ownership of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupownership_system_commands_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that system commands files are group owned by root </title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupownership_system_commands_dirs"/>
                  <description>
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by root group.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_var_log_messages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns /var/log/messages File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_var_log_messages"/>
                  <description>This test makes sure that /var/log/messages is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_var_log_messages:tst:1" comment="Check file group ownership of /var/log/messages"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_var_log:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns /var/log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_var_log"/>
                  <description>This test makes sure that /var/log/ is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_var_log:tst:1" comment="Check file group ownership of /var/log/"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify /boot/grub2/grub.cfg Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_grub2_cfg"/>
                  <description>This test makes sure that /boot/grub2/grub.cfg is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_grub2_cfg:tst:1" comment="Check file group ownership of /boot/grub2/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_shadow:tst:1" comment="Check file group ownership of /etc/shadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd:tst:1" comment="Check file group ownership of /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_motd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Ownership of Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_motd"/>
                  <description>This test makes sure that /etc/motd is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_motd:tst:1" comment="Check file group ownership of /etc/motd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_issue:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Ownership of System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_issue"/>
                  <description>This test makes sure that /etc/issue is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_issue:tst:1" comment="Check file group ownership of /etc/issue"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" comment="Check file group ownership of /etc/gshadow"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_etc_group"/>
                  <description>This test makes sure that /etc/group is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_etc_group:tst:1" comment="Check file group ownership of /etc/group"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify the UEFI Boot Loader grub.cfg Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_efi_grub2_cfg"/>
                  <description>This test makes sure that /boot/efi/EFI/fedora/grub.cfg is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1" comment="Check file group ownership of /boot/efi/EFI/fedora/grub.cfg"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify User Who Owns Backup shadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_shadow"/>
                  <description>This test makes sure that /etc/shadow- is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1" comment="Check file group ownership of /etc/shadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup passwd File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_passwd"/>
                  <description>This test makes sure that /etc/passwd- is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1" comment="Check file group ownership of /etc/passwd-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup gshadow File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_gshadow"/>
                  <description>This test makes sure that /etc/gshadow- is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1" comment="Check file group ownership of /etc/gshadow-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-file_groupowner_backup_etc_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Group Who Owns Backup group File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="file_groupowner_backup_etc_group"/>
                  <description>This test makes sure that /etc/group- is group owned by 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_group:tst:1" comment="Check file group ownership of /etc/group-"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-etc_system_fips_exists:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure '/etc/system-fips' exists</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="etc_system_fips_exists"/>
                  <description>Check /etc/system-fips exists</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" comment="/etc/system-fips exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_logrotate_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Logrotate Runs Periodically</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_logrotate_activated"/>
                  <description>
      The frequency of automatic log files rotation performed by the logrotate utility should be configured to run daily
      </description>
                </metadata>
                <criteria comment="/etc/logrotate.conf contains daily setting and /etc/cron.daily/logrotate file exists">
                  <criterion test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1" comment="Check if daily is set in /etc/logrotate.conf"/>
                  <criterion test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" comment="check that there is no weekly/monthly/yearly keyword in logrotate.conf"/>
                  <criterion test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1" comment="Check if /etc/cron.daily/logrotate file exists (and calls logrotate)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled for All dnf Package Repositories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_never_disabled"/>
                  <description>Ensure all yum or dnf repositories utilize signature checking.</description>
                </metadata>
                <criteria comment="ensure all yum or dnf repositories utilize signiature checking">
                  <criterion test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" comment="verify no gpgpcheck=0 present in /etc/yum.repos.d files"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_local_packages:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled for Local Packages</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_local_packages"/>
                  <description>The localpkg_gpgcheck option should be used to ensure that checking 
      of an RPM package's signature always occurs prior to its
      installation.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure gpgcheck Enabled In Main dnf Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_gpgcheck_globally_activated"/>
                  <description>The gpgcheck option should be used to ensure that checking
      of an RPM package's signature always occurs prior to its
      installation.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" comment="check value of gpgcheck in /etc/dnf/dnf.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure Fedora GPG Key Installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="ensure_fedora_gpgkey_installed"/>
                  <description>The Fedora release key package is required to be installed.</description>
                </metadata>
                <criteria comment="Fedora Vendor keys">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_fedora:def:1" comment="Fedora installed"/>
                  <criteria operator="OR" comment="Supported Fedora key is installed">
                    <criterion test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" comment="Fedora 35 package gpg-pubkey-9867c58f-601c49ca is installed"/>
                    <criterion test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" comment="Fedora 34 package gpg-pubkey-45719a39-5f2c0192 is installed"/>
                    <criterion test_ref="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1" comment="Fedora 33 package gpg-pubkey-9570ff31-5e3006fb is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_pam_namespace:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set Up a Private Namespace in PAM Configuration</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_pam_namespace"/>
                  <description>Check presence of pam_namespace.so module in the /etc/pam.d/login file</description>
                </metadata>
                <criteria comment="Check that /etc/pam.d/login contains a line with certain text">
                  <criterion test_ref="oval:ssg-test_enable_pam_namespace:tst:1" comment="Check that /etc/pam.d/login contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_fips_mode:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable FIPS Mode</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_fips_mode"/>
                  <description>Check if FIPS mode is enabled on the system</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-etc_system_fips_exists:def:1" comment="check /etc/system-fips exists"/>
                  <extend_definition definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1" comment="check sysctl crypto.fips_enabled = 1"/>
                  <extend_definition definition_ref="oval:ssg-enable_dracut_fips_module:def:1" comment="Dracut FIPS module is enabled"/>
                  <extend_definition definition_ref="oval:ssg-configure_crypto_policy:def:1" comment="system cryptography policy is configured"/>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_FIPS_certified:def:1" comment="Installed OS is FIPS certified"/>
                  <criterion test_ref="oval:ssg-test_system_crypto_policy_value:tst:1" comment="check if system crypto policy selection in var_system_crypto_policy in the profile is set to FIPS"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_dracut_fips_module:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Dracut FIPS Module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_dracut_fips_module"/>
                  <description>fips module should be enabled in Dracut configuration</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1" comment="dracut fips module is enabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-enable_dconf_user_profile:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure GNOME3 DConf User Profile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="enable_dconf_user_profile"/>
                  <description>The DConf User profile should have the local DB configured.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criterion test_ref="oval:ssg-test_dconf_user_profile:tst:1" comment="dconf user profile exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dnf-automatic_security_updates_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure dnf-automatic to Install Only Security Updates</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dnf-automatic_security_updates_only"/>
                  <description>Ensure 'upgrade_type' is configured with value 'security in section 'commands' in /etc/dnf/automatic.conf</description>
                </metadata>
                <criteria comment="dnf-automatic is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="dnf-automatic is configured correctly">
                    <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" comment="Check the upgrade_type in /etc/dnf/automatic.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dnf-automatic_apply_updates:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure dnf-automatic to Install Available Updates Automatically</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dnf-automatic_apply_updates"/>
                  <description>Ensure 'apply_updates' is configured with value 'yes in section 'commands' in /etc/dnf/automatic.conf</description>
                </metadata>
                <criteria comment="dnf-automatic is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="dnf-automatic is configured correctly">
                    <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1" comment="Check the apply_updates in /etc/dnf/automatic.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" comment="test if configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-display_login_attempts:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Displays Last Logon/Access Notification</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="display_login_attempts"/>
                  <description>Configure the system to notify users of last login/access using pam_lastlog.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_display_login_attempts:tst:1" comment="Conditions for pam_lastlog are satisfied"/>
                  <criterion test_ref="oval:ssg-test_display_login_attempts_silent:tst:1" comment="silent option for pam_lastlog is not set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_users_coredumps:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Core Dumps for All Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_users_coredumps"/>
                  <description>Core dumps for all users should be disabled</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_core_dumps_limits_d:tst:1" comment="Are core dumps disabled in /etc/security/limits.d/*"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" negate="true" comment="Are core dumps configured in /etc/security/limits.d/*"/>
                    <criterion test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1" comment="Are core dumps disabled in /etc/security/limits.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_host_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Host-Based Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_host_auth"/>
                  <description>Ensure 'HostbasedAuthentication' is configured with value 'no' in /etc/ssh/sshd_config and in /etc/ssh/sshd_config.d</description>
                </metadata>
                <criteria operator="OR" comment="sshd is configured correctly or is not installed">
                  <criteria comment="sshd is not installed">
                    <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" comment="sshd is not required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" comment="rpm package openssh-server removed"/>
                  </criteria>
                  <criteria comment="sshd is installed and configured">
                    <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" comment="sshd is required or requirement is unset"/>
                    <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" comment="rpm package openssh-server installed"/>
                    <criteria operator="OR" comment="sshd is configured correctly">
                      <criterion test_ref="oval:ssg-test_disable_host_auth:tst:1" comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config"/>
                      <criteria comment="sshd is not configured incorrectly">
                        <criterion test_ref="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1" comment="Check the absence of HostbasedAuthentication in /etc/ssh/sshd_config"/>
                        <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1" comment="Check the absence of HostbasedAuthentication in /etc/ssh/sshd_config.d"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1" comment="Check the HostbasedAuthentication in /etc/ssh/sshd_config.d"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Ctrl-Alt-Del Reboot Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="disable_ctrlaltdel_reboot"/>
                  <description>By default, the system will reboot when the
      Ctrl-Alt-Del key sequence is pressed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" comment="Disable Ctrl-Alt-Del systemd softlink exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-directory_permissions_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>System Audit Logs Must Have Mode 0750 or Less Permissive</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="directory_permissions_var_log_audit"/>
                  <description>Checks for correct permissions for /var/log/audit.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" negate="true"/>
                  <criteria comment="log_group in auditd.conf is not root">
                    <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" comment="log_group in auditd.conf is not root"/>
                    <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" negate="true"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-directory_access_var_log_audit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Access Events to Audit Log Directory</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="directory_access_var_log_audit"/>
                  <description>Audit rules about the read events to /var/log/audit</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" comment="audit rule to record read access events to /var/log/audit"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" comment="audit rule to record read access events to /var/log/audit"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Group Owned by a System Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_system_owned_group"/>
                  <description>All world writable directories should be group owned by a system user.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have gid greater than or equal to 1000">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" comment="check for local directories that are world writable and have gid greater than or equal to 1000"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_system_owned:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Owned by a System Account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_system_owned"/>
                  <description>All world writable directories should be owned by a system user.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have uid greater than or equal to 1000">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" comment="check for local directories that are world writable and have uid greater than or equal to 1000"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_sticky_bits"/>
                  <description>The sticky bit should be set for all world-writable directories.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" negate="true" comment="all local world writable directories have sticky bit set"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_perms_world_writable_root_owned:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All World-Writable Directories Are Owned by root user</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_perms_world_writable_root_owned"/>
                  <description>All world writable directories should be owned by root.</description>
                </metadata>
                <criteria negate="true" comment="check for local directories that are world writable and have uid greater than 0">
                  <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" comment="check for local directories that are world writable and have uid greater than 0"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_permissions_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Restrictive Permissions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_permissions_library_dirs"/>
                  <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        objects therein, are not group-writable or world-writable.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-dir_test_perms_lib_dir:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Root Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_ownership_library_dirs"/>
                  <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        directories therein, are owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_dir_ownership_lib_dir:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dir_group_ownership_library_dirs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify that Shared Library Directories Have Root Group Ownership</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dir_group_ownership_library_dirs"/>
                  <description>
        Checks that /lib, /lib64, /usr/lib, /usr/lib64, /lib/modules, and
        directories therein, are group-owned by root.
      </description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_dir_group_ownership_lib_dir:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Session Idle Settings</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_session_idle_user_locks"/>
                  <description>Ensure that users cannot change GNOME3 session idle settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Settings</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_user_locks"/>
                  <description>Ensure that users cannot change GNOME3 screensaver idle and lock settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1" comment="prevent user from changing screensaver lock delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Full User Name on Splash Shield</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_user_info"/>
                  <description>GNOME3 screen splash shield should not display full name of logged in user.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable screensaver user info and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1" comment="screensaver user info is disabled"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_info_change:tst:1" comment="screensaver prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" version="2" class="compliance">
                <metadata>
                  <title>Implement Blank Screensaver</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_mode_blank"/>
                  <description>The GNOME3 screensaver should be blank.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable blank screensaver and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_mode_blank:tst:1" comment="screensaver is blank"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" comment="screensaver prevent user from changing mode"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_locked"/>
                  <description>Idle activation of the screen lock should not be changed by users.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" comment="screensaver lock prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Screensaver Lock After Idle Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_enabled"/>
                  <description>Idle activation of the screen lock should be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1" comment="screensaver lock is enabled"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1" comment="screensaver lock prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set GNOME3 Screensaver Lock Delay After Activation Period</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_lock_delay"/>
                  <description>Idle activation of the screen lock should be enabled immediately or
      after a delay.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable screensaver lock and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_delay:tst:1" comment="screensaver lock delay is configured"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_lock_delay:tst:1" comment="prevent user from changing screensaver lock delay"/>
                    <criterion test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1" comment="lock delay is set correctly"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set GNOME3 Screensaver Inactivity Timeout</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_delay"/>
                  <description>The allowed period of inactivity before the screensaver is activated.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle delay and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_delay:tst:1" comment="idle delay has been configured"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_idle_delay:tst:1" comment="prevent user from changing idle delay"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1" comment="idle delay is set correctly"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Users Cannot Change GNOME3 Screensaver Idle Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_activation_locked"/>
                  <description>Idle activation of the screen saver should not be changed by users.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle activation and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Screensaver Idle Activation</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_screensaver_idle_activation_enabled"/>
                  <description>Idle activation of the screen saver should be enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check screensaver idle activation and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" comment="idle activation has been configured"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Encryption for Remote Access in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_remote_access_encryption"/>
                  <description>Configure GNOME3 to require encryption for remote access connections.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1" comment="configure remote access encryption"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" version="1" class="compliance">
                <metadata>
                  <title>Require Credential Prompting for Remote Access in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_remote_access_credential_prompt"/>
                  <description>Configure GNOME3 to require credential prompting for remote access.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_remote_access_creds:tst:1" comment="configure remote access credentials"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_login_retries:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the GNOME3 Login Number of Failures</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_login_retries"/>
                  <description>Set the GNOME3 number of login failure attempts.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Set number of login attempts and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_configure_allowed_failures:tst:1" comment="Set number of login tries"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_login_banner_text:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set the GNOME3 Login Warning Banner Text</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_login_banner_text"/>
                  <description>Enable the GUI warning banner.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable GUI banner and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_banner_change:tst:1" comment="Prevent user from changing banner"/>
                    <criterion test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1" comment="Login banner is correctly set"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the GNOME3 Screen Locking On Smartcard Removal</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_lock_screen_on_smartcard_removal"/>
                  <description>Ensure 'removal-action' is configured with value ''lock-screen' in section 'org/gnome/settings-daemon/peripherals/smartcard' in /etc/dconf/db/local.d/</description>
                </metadata>
                <criteria comment="dconf is configured correctly">
                  <criterion test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" comment="Check the removal-action in /etc/dconf/db/local.d/"/>
                  <criterion test_ref="oval:ssg-test_prevent_user_removal-action:tst:1" comment="Prevent user from modifying removal-action"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable the GNOME3 Login Smartcard Authentication</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_enable_smartcard_auth"/>
                  <description>Enable smartcard authentication in the GNOME3 Login GUI.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable smartcard authentication and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1" comment="Enable smartcard authentication"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable WIFI Network Notification in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_wifi_notification"/>
                  <description>Disable the GNOME3 wireless network notification.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_wifi_notification:tst:1" comment="Disable wifi notification"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable WIFI Network Connection Creation in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_wifi_create"/>
                  <description>Disable the GNOME3 wireless network creation settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_wifi_creation:tst:1" comment="Disable wifi creation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_user_list:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the GNOME3 Login User List</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_user_list"/>
                  <description>Disable the GNOME3 GUI listing of all known users on the login screen.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GUI listing of known users and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_user_list:tst:1" comment="Disable user list"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1" comment="Prevent user from disabling banner"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_user_admin:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable User Administration in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_user_admin"/>
                  <description>Ensure 'user-administration-disabled' is configured with value 'true in section 'org/gnome/desktop/lockdown' in /etc/dconf/db/local.d/</description>
                </metadata>
                <criteria comment="dconf is configured correctly">
                  <criterion test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" comment="Check the user-administration-disabled in /etc/dconf/db/local.d/"/>
                  <criterion test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" comment="Prevent user from modifying user-administration-disabled"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable All GNOME3 Thumbnailers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_thumbnailers"/>
                  <description>The system's default desktop environment, GNOME3, uses a
      number of different thumbnailer programs to generate thumbnails for any
      new or modified content in an opened folder. Disable the execution of
      these thumbnail applications within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable Gnome3 Thumbnailers and prevent user from enabling">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1" comment="Disable thumbnailers in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" comment="prevent user from changing idle delay"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable the GNOME3 Login Restart and Shutdown Buttons</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_restart_shutdown"/>
                  <description>Disable the GNOME3 Login GUI Restart and Shutdown buttons to all users on the login screen.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GUI shutdown and restart buttons and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_restart_buttons:tst:1" comment="Disable restart and shutdown buttons"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_power_settings:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Power Settings in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_power_settings"/>
                  <description>Disable GNOME3 power settings.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1" comment="Disable power settings"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_geolocation:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Geolocation in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_geolocation"/>
                  <description>Disable GNOME3 Geolocation for the clock and system.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_sys_geolocation:tst:1" comment="Disable system geolocation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1" comment="Prevent user from changing"/>
                    <criterion test_ref="oval:ssg-test_disable_clock_geolocation:tst:1" comment="Disable clock geolocation"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_ctrlaltdel_reboot"/>
                  <description>Disable the GNOME3 ctrl-alt-del reboot key sequence in GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" comment="Disable Ctrl-Alt-Del"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" comment="Prevent user from changing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_autorun:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GNOME3 autorun</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_autorun"/>
                  <description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable autorun within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 autorun and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" comment="Disable autorun in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1" comment="Prevent user from changing autorun setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_automount_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable GNOME3 automount-open</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_automount_open"/>
                  <description>The system's default desktop environment, GNOME3, will mount
    devices and removable media (such as DVDs, CDs and USB flash drives)
    whenever they are inserted into the system. Disable automount-open within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 automount/autorun and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" comment="Disable automount-open in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" comment="Prevent user from changing automount-open setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_disable_automount:def:1" version="2" class="compliance">
                <metadata>
                  <title>Disable GNOME3 automount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_disable_automount"/>
                  <description>The system's default desktop environment, GNOME3, will mount
      devices and removable media (such as DVDs, CDs and USB flash drives)
      whenever they are inserted into the system. Disable automount within GNOME3.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Disable GNOME3 automount and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1" comment="Disable automount in GNOME3"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1" comment="Prevent user from changing automount setting"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_gnome_banner_enabled:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable GNOME3 Login Warning Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_gnome_banner_enabled"/>
                  <description>Enable the GNOME3 Login warning banner.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="Enable GUI banner and prevent user from changing it">
                    <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" comment="dconf user profile exists"/>
                    <criterion test_ref="oval:ssg-test_banner_gui_enabled:tst:1" comment="Enable GUI banner"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" comment="Prevent user from disabling banner"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-dconf_db_up_to_date:def:1" version="2" class="compliance">
                <metadata>
                  <title>Make sure that the dconf databases are up-to-date with regards to respective keyfiles</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="dconf_db_up_to_date"/>
                  <description>Make sure that the dconf databases are up-to-date with regards to respective keyfiles.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" negate="true" comment="dconf installed"/>
                  <criteria comment="check that all DBs in question are up-to-date">
                    <criteria operator="OR" comment="check that all DBs in question are up-to-date">
                      <criterion test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1" comment="local database is up-to-date wrt keyfiles"/>
                      <criterion test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1" comment="no keyfiles applicable to the local database"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure SELinux Not Disabled in the kernel arguments</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coreos_enable_selinux_kernel_argument"/>
                  <description>Ensure selinux=0 argument is not present in the 'options' line of /boot/loader/entries/ostree-2-*.conf (or ostree-1-*.conf if there is no ostree-2-*.conf as ostree has only two enries at the most, with *-2-*.conf entry always being the most recent). Also, ensure that kernel is currently running with this argument by checking /proc/cmdline.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criteria>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" comment="Pass if there are no files matching pattern '/boot/loader/entries/ostree-2-.*.conf' exist in the system"/>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-1-.*.conf"/>
                    </criteria>
                    <criteria>
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /boot/loader/entries/ostree-2-.*.conf"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" negate="true" comment="Check if argument selinux=0 for Linux kernel is not present in /proc/cmdline"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-coredump_disable_storage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable storing core dump</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coredump_disable_storage"/>
                  <description>Ensure 'Storage' is configured with value 'none in section 'Coredump' in /etc/systemd/coredump.conf</description>
                </metadata>
                <criteria operator="OR" comment="systemd-coredump is configured correctly">
                  <criterion test_ref="oval:ssg-test_coredump_disable_storage:tst:1" comment="Check the Storage in /etc/systemd/coredump.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-coredump_disable_backtraces:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable core dump backtraces</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="coredump_disable_backtraces"/>
                  <description>Ensure 'ProcessSizeMax' is configured with value '0 in section 'Coredump' in /etc/systemd/coredump.conf</description>
                </metadata>
                <criteria operator="OR" comment="systemd-coredump is configured correctly">
                  <criterion test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1" comment="Check the ProcessSizeMax in /etc/systemd/coredump.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_usbguard_auditbackend:def:1" version="1" class="compliance">
                <metadata>
                  <title>Log USBGuard daemon audit events using Linux Audit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_usbguard_auditbackend"/>
                  <description>Ensure 'AuditBackend' is configured with value 'LinuxAudit' in /etc/usbguard/usbguard-daemon.conf</description>
                </metadata>
                <criteria comment="usbguard is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="usbguard is configured correctly">
                    <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1" comment="Check the AuditBackend in /etc/usbguard/usbguard-daemon.conf"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" comment="test if configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_tmux_lock_command:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure the tmux Lock Command</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_tmux_lock_command"/>
                  <description>Check if the vlock command is configured to be used as a locking mechanism in tmux.</description>
                </metadata>
                <criteria comment="Configure the tmux Lock Command">
                  <criterion test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1" comment="check lock-command is set to vlock in /etc/tmux.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_tmux_lock_after_time:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure tmux to lock session after inactivity</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_tmux_lock_after_time"/>
                  <description>Check if tmux is configured to lock sessions after period of inactivity.</description>
                </metadata>
                <criteria comment="Configure tmux to lock session after inactivity">
                  <criterion test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1" comment="check lock-after-time is set to 900 in /etc/tmux.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_ssh_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure SSH to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_ssh_crypto_policy"/>
                  <description>SSH should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" comment="Check that the SSH configuration mandates usage of system-wide crypto policies."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_openssl_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure OpenSSL library to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_openssl_crypto_policy"/>
                  <description>OpenSSL should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" comment="Check that the configuration mandates usage of system-wide crypto policies."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_opensc_nss_db:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure NSS DB To Use opensc</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_opensc_nss_db"/>
                  <description>The NSS DB should be set to use opensc library.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_opensc_card_drivers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure opensc Smart Card Drivers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_opensc_card_drivers"/>
                  <description>Configure the organization's smart card driver so that only
      the smart card in use by the organization will be recognized by the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" comment="Check that card_drivers is configured for opensc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_libreswan_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Libreswan to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_libreswan_crypto_policy"/>
                  <description>Libreswan should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_libreswan_installed:def:1" negate="true" comment="Check if package libreswan is not installed"/>
                  <criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" comment="Check that the libreswan configuration includes the crypto policy config file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_kerberos_crypto_policy:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure Kerberos to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_kerberos_crypto_policy"/>
                  <description>Kerberos should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR" comment="The config file is always a symlink to the backend, but the backend itself may be either a file, or a symlink. For this reason, we need two tests, if one passes, the other one is expected to either fail, or error.">
                  <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" comment="kerberos crypto-policy configuration links to same file as kerberos crypto-policy backend"/>
                  <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" comment="kerberos crypto-policy configuration links to the crypto-policy backend file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure GnuTLS library to use DoD-approved TLS Encryption</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_gnutls_tls_crypto_policy"/>
                  <description>Check presence of +VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0 in /etc/crypto-policies/back-ends/gnutls.config</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" comment="Check that /etc/crypto-policies/back-ends/gnutls.config contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure System Cryptography Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_crypto_policy"/>
                  <description>Ensure crypto policy is correctly configured in /etc/crypto-policies/config, and the policy is current.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_configure_crypto_policy:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policy/config"/>
                  <criterion test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1" comment="check for crypto policy correctly configured in /etc/crypto-policy/state/current"/>
                  <criterion test_ref="oval:ssg-test_crypto_policies_updated:tst:1" comment="Check if update-crypto-policies has been run after config update"/>
                  <criterion test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1" comment="Check if /etc/crypto-policies/back-ends/nss.config exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_bind_crypto_policy:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure BIND to use System Crypto Policy</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_bind_crypto_policy"/>
                  <description>BIND should be configured to use the system-wide crypto policy setting.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-package_bind_removed:def:1" comment="Check if package bind is not installed"/>
                  <criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" comment="Check that the configuration includes the policy config file."/>
                </criteria>
              </definition>
              <definition id="oval:ssg-configure_bashrc_exec_tmux:def:1" version="1" class="compliance">
                <metadata>
                  <title>Support session locking with tmux</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="configure_bashrc_exec_tmux"/>
                  <description>Check if tmux is configured to exec at the end of bashrc.</description>
                </metadata>
                <criteria comment="Check exec tmux configured at the end of bashrc">
                  <criterion test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" comment="check tmux is configured to exec on the last line of /etc/bashrc"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_specify_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>A remote time server for Chrony is configured</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_specify_remote_server"/>
                  <description>A remote NTP Server for time synchronization should be
      specified (and dependencies are met)</description>
                </metadata>
                <criteria comment="chrony.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify Multiple Remote chronyd NTP Servers for Time Data</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_specify_multiple_servers"/>
                  <description>Multiple chronyd NTP Servers for time synchronization should be specified.</description>
                </metadata>
                <criteria comment="chrony.conf conditions are met">
                  <criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_run_as_chrony_user:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure that chronyd is running under chrony user account</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_run_as_chrony_user"/>
                  <description>Ensure 'OPTIONS' is configured with value '["]?.*-u chrony.*["]?' in /etc/sysconfig/chronyd</description>
                </metadata>
                <criteria comment="The respective application or service is configured correctly and configuration file exists">
                  <criteria operator="OR" comment="The respective application or service is configured correctly">
                    <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" comment="Check the OPTIONS in /etc/sysconfig/chronyd"/>
                  </criteria>
                  <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" comment="test if configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify a Remote NTP Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_specify_remote_server"/>
                  <description>A remote chronyd or ntpd NTP Server for time synchronization should be specified (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="chronyd enabled and remote server specified">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                    <extend_definition definition_ref="oval:ssg-chronyd_specify_remote_server:def:1" comment="chronyd remote server specified"/>
                  </criteria>
                  <criteria comment="ntpd enabled and remote server specified">
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                    <extend_definition definition_ref="oval:ssg-ntpd_specify_remote_server:def:1" comment="ntpd remote server specified"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" version="1" class="compliance">
                <metadata>
                  <title>Specify Additional Remote NTP Servers</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_specify_multiple_servers"/>
                  <description>Multiple remote chronyd or ntpd NTP Servers for time synchronization should be specified (and dependencies are met)</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="chronyd enabled and multiple remote servers specified">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                    <extend_definition definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1" comment="multiple chronyd remote servers specified"/>
                  </criteria>
                  <criteria comment="ntpd enabled and multile remote servers specified">
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" comment="service ntpd enabled"/>
                    <extend_definition definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1" comment="multiple ntpd remote servers specified"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Time Service Maxpoll Interval</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_or_ntpd_set_maxpoll"/>
                  <description>Configure the maxpoll setting in /etc/ntp.conf or chrony.conf
      to continuously poll the time source servers.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <criterion test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1" comment="check if maxpoll is set in /etc/ntp.conf"/>
                    <criterion test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" comment="check if all server entries have maxpoll set in /etc/ntp.conf"/>
                  </criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1" comment="check if maxpoll is set in /etc/chrony.conf"/>
                    <criterion test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" comment="check if all server entries have maxpoll set in /etc/chrony.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_no_chronyc_network:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable network management of chrony daemon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_no_chronyc_network"/>
                  <description>Configure the cmdport setting in /etc/chrony.conf to disable
      chronyc management connections over network.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" comment="check if cmdport is 0 in /etc/chrony.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-chronyd_client_only:def:1" version="1" class="compliance">
                <metadata>
                  <title>Disable chrony daemon from acting as server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="chronyd_client_only"/>
                  <description>Configure the port setting in /etc/chrony.conf to disable
      server operation.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" comment="service chronyd enabled"/>
                  <criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" comment="check if port is 0 in /etc/chrony.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify GRUB_DISABLE_RECOVERY Set to true</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="bootloader_disable_recovery_set_to_true"/>
                  <description>GRUB_DISABLE_RECOVERY set to 'true' in
      /etc/default/grub</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-bios_enable_execution_restrictions:def:1" version="2" class="compliance">
                <metadata>
                  <title>Enable NX or XD Support in the BIOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="bios_enable_execution_restrictions"/>
                  <description>The NX (no-execution) bit flag should be set on the system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_NX_cpu_support:tst:1" comment="NX bit is set"/>
                  <criterion test_ref="oval:ssg-test_messages_nx_active:tst:1" comment="No log messages about NX being disabled"/>
                  <criterion test_ref="oval:ssg-test_noexec_cmd_line:tst:1" comment="NX is not disabled in the kernel command line"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-banner_etc_motd:def:1" version="2" class="compliance">
                <metadata>
                  <title>Modify the System Message of the Day Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="banner_etc_motd"/>
                  <description>The system login banner text should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_banner_etc_motd:tst:1" comment="/etc/motd is set appropriately"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-banner_etc_issue:def:1" version="2" class="compliance">
                <metadata>
                  <title>Modify the System Login Banner</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="banner_etc_issue"/>
                  <description>The system login banner text should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_banner_etc_issue:tst:1" comment="/etc/issue is set appropriately"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_write_logs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Write Audit Logs to the Disk</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_write_logs"/>
                  <description>Ensure 'write_logs' is configured with value 'yes' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_write_logs:tst:1" comment="Check the write_logs in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" comment="Check the absence of write_logs in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_overflow_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Appropriate Action Must be Setup When the Internal Audit Event Queue is Full</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_overflow_action"/>
                  <description>Ensure 'overflow_action' is configured with value '(syslog|single|halt)' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="The respective application or service is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_overflow_action:tst:1" comment="Check the overflow_action in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_name_format:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set hostname as computer node name in audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_name_format"/>
                  <description>Ensure 'name_format' is configured with value 'hostname' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_name_format:tst:1" comment="Check the name_format in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_log_format:def:1" version="1" class="compliance">
                <metadata>
                  <title>Resolve information before writing to audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_log_format"/>
                  <description>Ensure 'log_format' is configured with value 'ENRICHED' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_log_format:tst:1" comment="Check the log_format in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_local_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Include Local Events in Audit Logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_local_events"/>
                  <description>Ensure 'local_events' is configured with value 'yes' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_local_events:tst:1" comment="Check the local_events in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" comment="Check the absence of local_events in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_freq:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of records to cause an explicit flush to audit logs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_freq"/>
                  <description>Ensure 'freq' is configured with value '50' in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria operator="OR" comment="auditd is configured correctly">
                  <criterion test_ref="oval:ssg-test_auditd_freq:tst:1" comment="Check the freq in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd space_left on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_space_left_percentage"/>
                  <description>space_left setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" comment="space_left setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_space_left_action:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure auditd space_left Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_space_left_action"/>
                  <description>space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" comment="space_left_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_num_logs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd Number of Logs Retained</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_num_logs"/>
                  <description>num_logs setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1" comment="num_logs setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_max_log_file_action"/>
                  <description>max_log_file_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" comment="max_log_file_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_max_log_file:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd Max Log File Size</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_max_log_file"/>
                  <description>max_log_file setting in /etc/audit/auditd.conf is set to at least a certain value</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" comment="max_log_file setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_flush:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd flush priority</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_flush"/>
                  <description>The setting for flush in /etc/audit/auditd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1" comment="flush setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd admin_space_left Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_admin_space_left_action"/>
                  <description>admin_space_left_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" comment="admin_space_left_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" version="2" class="compliance">
                <metadata>
                  <title>Configure auditd mail_acct Action on Low Disk Space</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_retention_action_mail_acct"/>
                  <description>action_mail_acct setting in /etc/audit/auditd.conf is set to a certain account</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" comment="action_mail_acct setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_disk_full_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd Disk Full Action when Disk Space Is Full</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_disk_full_action"/>
                  <description>disk_full_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1" comment="disk_full_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_data_disk_error_action:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd Disk Error Action on Disk Error</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_data_disk_error_action"/>
                  <description>disk_error_action setting in /etc/audit/auditd.conf is set to a certain action</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1" comment="disk_error_action setting in auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" class="compliance">
                <metadata>
                  <title>'log_group' Not Set To 'root' In /etc/audit/auditd.conf</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_conf_log_group_not_root"/>
                  <description>Verify 'log_group' is not set to 'root' in
      /etc/audit/auditd.conf.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" comment="Verify 'log_group' not set to 'root' in /etc/audit/auditd.conf"/>
                  <criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" comment="Verify 'log_group' is set in /etc/audit/auditd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure auditd to use audispd's syslog plugin</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_syslog_plugin_activated"/>
                  <description>active setting in /etc/audit/plugins.d/syslog.conf is set to 'yes'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" comment="active setting in syslog.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" version="1" class="compliance">
                <metadata>
                  <title>Encrypt Audit Records Sent With audispd Plugin</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_encrypt_sent_records"/>
                  <description>transport setting in /etc/audit/audisp-remote.conf is set to 'KRB5'</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" comment="setting in audisp-remote.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-auditd_audispd_configure_remote_server:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure audispd Plugin To Send Logs To Remote Server</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="auditd_audispd_configure_remote_server"/>
                  <description>remote_server setting in /etc/audit/audisp-remote.conf is set to a certain IP address or hostname</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" comment="remote_server setting in audisp-remote.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_shadow"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" comment="audit shadow"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" comment="audit shadow"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_passwd"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" comment="audit passwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" comment="audit passwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/security/opasswd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_opasswd"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" comment="audit opasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" comment="audit opasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_gshadow"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" comment="audit gshadow"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" comment="audit gshadow"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification_group:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification_group"/>
                  <description>Audit user/group modification.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" comment="audit group"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" comment="audit group"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_usergroup_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_usergroup_modification"/>
                  <description>Audit rules should detect modification to system files that hold information about users and groups.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" comment="audit /etc/group"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" comment="audit /etc/passwd"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" comment="audit /etc/gshadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" comment="audit /etc/shadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" comment="audit /etc/security/opasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" comment="audit /etc/group"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" comment="audit /etc/passwd"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" comment="audit /etc/gshadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" comment="audit /etc/shadow"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" comment="audit /etc/security/opasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - unlinkat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_unlinkat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - unlink</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_unlink"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - truncate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_truncate"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - setxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_setxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - renameat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_renameat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Delete Attempts to Files - rename</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_rename"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - removexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_removexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of openat is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of openat O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - openat O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of openat O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule openat 32bit a2&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule openat 64bit a2&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - openat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_openat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of open is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of open O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - open O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of open O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open 32bit a1&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open 64bit a1&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at is configured in the proper rule order.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" comment="audit augenrules 64-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" comment="audit augenrules 32-bit"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_TRUNC is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;01003 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;01003 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat"/>
                  <description>Audit rules about the information on the unsuccessful use of open_by_handle_at O_CREAT is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces augenrules exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm augenrules exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces augenrules exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm augenrules exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eacces auditctl exists"/>
                    <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 32bit a2&amp;0100 eperm auditctl exists"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eacces auditctl exists"/>
                        <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" comment="Verify audit rule open_by_handle_at 64bit a2&amp;0100 eperm auditctl exists"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - open_by_handle_at</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open_by_handle_at"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - open</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_open"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - lsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lsetxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - lremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lremovexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - lchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_lchown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - ftruncate</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_ftruncate"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fsetxattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fremovexattr"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - fchownat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchownat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - fchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fchmodat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchmodat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - fchmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_fchmod"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessful Access Attempts to Files - creat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_creat"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Ownership Changes to Files - chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_chown"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Unsuccessul Permission Changes to Files - chmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification_chmod"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" comment="audit augenrules 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" comment="audit augenrules 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" comment="audit augenrules 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" comment="audit augenrules 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" comment="audit auditctl 32-bit file eacces"/>
                    <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" comment="audit auditctl 32-bit file eperm"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criteria>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" comment="audit auditctl 64-bit file eacces"/>
                        <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" comment="audit auditctl 64-bit file eperm"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_unsuccessful_file_modification"/>
                  <description>Audit rules about the unauthorized access attempts to files (unsuccessful) are enabled.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" comment="audit creat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" comment="audit ftruncate"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" comment="audit openat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" comment="audit open_by_handle_at"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" comment="audit open"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" comment="audit truncate"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_watch_localtime:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter the localtime File</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_watch_localtime"/>
                  <description>Record attempts to alter time through /etc/localtime.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" comment="audit /etc/localtime watch augenrules"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" comment="audit /etc/localtime watch auditctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_stime:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Time Through stime</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_stime"/>
                  <description>Record attempts to alter time through stime. Note that on
      64-bit architectures the stime system call is not defined in the audit
      system calls lookup table.</description>
                </metadata>
                <criteria>
                  <criteria operator="OR" comment="32-bit or 64-bit system">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" comment="32-bit system"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" comment="64-bit system"/>
                  </criteria>
                  <criteria operator="OR" comment="audit augenrules or audit auditctl">
                    <criteria comment="audit augenrules stime">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1" comment="audit augenrules 32-bit stime"/>
                    </criteria>
                    <criteria comment="audit auditctl stime">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1" comment="audit auditctl 32-bit stime"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_settimeofday:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record attempts to alter time through settimeofday</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_settimeofday"/>
                  <description>Record attempts to alter time through settimeofday.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" comment="audit augenrules 32-bit settimeofday"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" comment="audit augenrules 64-bit settimeofday"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" comment="audit auditctl 32-bit settimeofday"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" comment="audit auditctl 64-bit settimeofday"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_clock_settime:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Time Through clock_settime</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_clock_settime"/>
                  <description>Record attempts to alter time through clock_settime.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" comment="audit augenrules 32-bit clock_settime"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" comment="audit augenrules 64-bit clock_settime"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" comment="audit auditctl 32-bit clock_settime"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" comment="audit auditctl 64-bit clock_settime"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_time_adjtimex:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record attempts to alter time through adjtimex</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_time_adjtimex"/>
                  <description>Record attempts to alter time through adjtimex.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" comment="audit augenrules 32-bit adjtimex"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" comment="audit augenrules 64-bit adjtimex"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" comment="audit auditctl 32-bit adjtimex"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" comment="audit auditctl 64-bit adjtimex"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_sysadmin_actions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects System Administrator Actions</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_sysadmin_actions"/>
                  <description>Audit actions taken by system administrators on the system.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" comment="audit augenrules sudoers"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" comment="audit augenrules sudoers_d"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" comment="audit auditctl sudoers"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" comment="audit auditctl sudoers_d"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_session_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Process and Session Initiation Information</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_session_events"/>
                  <description>Audit rules should capture information about session initiation.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1" comment="audit augenrules utmp"/>
                    <criterion test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1" comment="audit augenrules btmp"/>
                    <criterion test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1" comment="audit augenrules wtmp"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1" comment="audit auditctl utmp"/>
                    <criterion test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1" comment="audit auditctl btmp"/>
                    <criterion test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1" comment="audit auditctl wtmp"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_usernetctl"/>
                  <description>Audit rules about the information on the use of usernetctl is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" comment="audit augenrules usernetctl"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" comment="audit auditctl usernetctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - userhelper</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_userhelper"/>
                  <description>Audit rules about the information on the use of userhelper is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" comment="audit augenrules userhelper"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" comment="audit auditctl userhelper"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_unix_chkpwd"/>
                  <description>Audit rules about the information on the use of unix_chkpwd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" comment="audit augenrules unix_chkpwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" comment="audit auditctl unix_chkpwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_umount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - umount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_umount"/>
                  <description>Audit rules about the information on the use of umount is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" comment="audit augenrules umount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" comment="audit auditctl umount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_sudoedit"/>
                  <description>Audit rules about the information on the use of sudoedit is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" comment="audit augenrules sudoedit"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" comment="audit auditctl sudoedit"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - sudo</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_sudo"/>
                  <description>Audit rules about the information on the use of sudo is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" comment="audit augenrules sudo"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" comment="audit auditctl sudo"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_su:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - su</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_su"/>
                  <description>Audit rules about the information on the use of su is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" comment="audit augenrules su"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" comment="audit auditctl su"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_ssh_keysign"/>
                  <description>Audit rules about the information on the use of ssh_keysign is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" comment="audit augenrules ssh_keysign"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" comment="audit auditctl ssh_keysign"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_pt_chown"/>
                  <description>Audit rules about the information on the use of pt_chown is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" comment="audit augenrules pt_chown"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" comment="audit auditctl pt_chown"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_passwd"/>
                  <description>Audit rules about the information on the use of passwd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" comment="audit augenrules passwd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" comment="audit auditctl passwd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newuidmap"/>
                  <description>Audit rules about the information on the use of newuidmap is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" comment="audit augenrules newuidmap"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" comment="audit auditctl newuidmap"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newgrp</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newgrp"/>
                  <description>Audit rules about the information on the use of newgrp is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" comment="audit augenrules newgrp"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" comment="audit auditctl newgrp"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_newgidmap"/>
                  <description>Audit rules about the information on the use of newgidmap is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" comment="audit augenrules newgidmap"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" comment="audit auditctl newgidmap"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_mount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - mount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_mount"/>
                  <description>Audit rules about the information on the use of mount is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" comment="audit augenrules mount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" comment="audit auditctl mount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_gpasswd"/>
                  <description>Audit rules about the information on the use of gpasswd is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" comment="audit augenrules gpasswd"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" comment="audit auditctl gpasswd"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - crontab</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_crontab"/>
                  <description>Audit rules about the information on the use of crontab is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" comment="audit augenrules crontab"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" comment="audit auditctl crontab"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - chsh</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_chsh"/>
                  <description>Audit rules about the information on the use of chsh is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" comment="audit augenrules chsh"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" comment="audit auditctl chsh"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_chage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - chage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_chage"/>
                  <description>Audit rules about the information on the use of chage is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" comment="audit augenrules chage"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" comment="audit auditctl chage"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands - at</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands_at"/>
                  <description>Audit rules about the information on the use of at is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" comment="audit augenrules at"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" comment="audit auditctl at"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_privileged_commands:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on the Use of Privileged Commands</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_privileged_commands"/>
                  <description>Audit rules about the information on the use of privileged commands are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" comment="audit augenrules suid sgid"/>
                    <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" comment="audit augenrules binaries count matches rules count"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" comment="audit auditctl suid sgid"/>
                    <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" comment="audit auditctl binaries count matches rules count"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification_hostname"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" comment="audit augenrules 32-bit sethostname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" comment="audit augenrules 64-bit sethostname"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" comment="audit auditctl 32-bit sethostname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" comment="audit auditctl 64-bit sethostname"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification_domainname"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" comment="audit augenrules 32-bit setdomainname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" comment="audit augenrules 64-bit setdomainname"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" comment="audit auditctl 32-bit setdomainname"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" comment="audit auditctl 64-bit setdomainname"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_networkconfig_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Network Environment</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_networkconfig_modification"/>
                  <description>The network environment should not be modified by anything other than
      administrator action. Any change to network parameters should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" comment="audit /etc/issue augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" comment="audit /etc/issue.net augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" comment="audit /etc/hosts augenrules"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" comment="audit /etc/sysconfig/network augenrules"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" comment="audit augenrules sethostname"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" comment="audit augenrules setdomainname"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" comment="audit /etc/issue auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" comment="audit /etc/issue.net auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" comment="audit /etc/hosts auditctl"/>
                    <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" comment="audit /etc/sysconfig/network auditctl"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" comment="audit augenrules sethostname"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" comment="audit augenrules setdomainname"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_media_export:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Exporting to Media (successful)</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_media_export"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" comment="audit augenrules 32-bit mount"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" comment="audit augenrules 64-bit mount"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" comment="audit auditctl 32-bit mount"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" comment="audit auditctl 64-bit mount"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_mac_modification:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Mandatory Access Controls</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_mac_modification"/>
                  <description>Audit rules that detect changes to the system's mandatory access controls (SELinux) are enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" comment="audit selinux changes augenrules"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" comment="audit selinux changes auditctl"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - tallylog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_tallylog"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1" comment="audit augenrules tallylog"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1" comment="audit auditctl tallylog"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - lastlog</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_lastlog"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1" comment="audit augenrules lastlog"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1" comment="audit auditctl lastlog"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events_faillock:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events - faillock</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events_faillock"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1" comment="audit augenrules faillock"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1" comment="audit auditctl faillock"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_login_events:def:1" version="2" class="compliance">
                <metadata>
                  <title>Record Attempts to Alter Logon and Logout Events</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_login_events"/>
                  <description>Audit rules should be configured to log successful and unsuccessful login and logout events.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1" comment="audit tallylog"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1" comment="audit faillock"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1" comment="audit lastlog"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading - init_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_init"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" comment="audit augenrules 32-bit init_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" comment="audit augenrules 64-bit init_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" comment="audit auditctl 32-bit init_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" comment="audit auditctl 64-bit init_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_finit"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" comment="audit augenrules 32-bit finit_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" comment="audit augenrules 64-bit finit_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" comment="audit auditctl 32-bit finit_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" comment="audit auditctl 64-bit finit_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Unloading - delete_module</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading_delete"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" comment="audit augenrules 32-bit delete_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" comment="audit augenrules 64-bit delete_module"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" comment="audit auditctl 32-bit delete_module"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" comment="audit auditctl 64-bit delete_module"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_kernel_module_loading:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_kernel_module_loading"/>
                  <description>The audit rules should be configured to log information about kernel module loading and unloading.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1" comment="audit init_module"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" comment="audit delete_module"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" comment="audit finit_module"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_immutable:def:1" version="1" class="compliance">
                <metadata>
                  <title>Make the auditd Configuration Immutable</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_immutable"/>
                  <description>Force a reboot to change audit rules is enabled</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_ari_locked_augenrules:tst:1" comment="audit augenrules configuration locked"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_ari_locked_auditctl:tst:1" comment="audit auditctl configuration locked"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - unlinkat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_unlinkat"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" comment="audit augenrules 32-bit unlinkat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" comment="audit augenrules 64-bit unlinkat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" comment="audit auditctl 32-bit unlinkat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" comment="audit auditctl 64-bit unlinkat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - unlink</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_unlink"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" comment="audit augenrules 32-bit unlink"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" comment="audit augenrules 64-bit unlink"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" comment="audit auditctl 32-bit unlink"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" comment="audit auditctl 64-bit unlink"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - rmdir</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_rmdir"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" comment="audit augenrules 32-bit rmdir"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" comment="audit augenrules 64-bit rmdir"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" comment="audit auditctl 32-bit rmdir"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" comment="audit auditctl 64-bit rmdir"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - renameat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_renameat"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" comment="audit augenrules 32-bit renameat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" comment="audit augenrules 64-bit renameat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" comment="audit auditctl 32-bit renameat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" comment="audit auditctl 64-bit renameat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User - rename</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events_rename"/>
                  <description>The deletion of files should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" comment="audit augenrules 32-bit rename"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" comment="audit augenrules 64-bit rename"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" comment="audit auditctl 32-bit rename"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" comment="audit auditctl 64-bit rename"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_file_deletion_events:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure auditd Collects File Deletion Events by User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_file_deletion_events"/>
                  <description>Audit files deletion events.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" comment="audit rmdir"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" comment="audit unlink"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" comment="audit unlinkat"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1" comment="audit rename"/>
                  <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" comment="audit renameat"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_seunshare:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run seunshare</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_seunshare"/>
                  <description>Audit rules about the information on the use of seunshare is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" comment="audit augenrules seunshare"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" comment="audit auditctl seunshare"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_setsebool:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run setsebool</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_setsebool"/>
                  <description>Audit rules about the information on the use of setsebool is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" comment="audit augenrules setsebool"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" comment="audit auditctl setsebool"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_semanage:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_semanage"/>
                  <description>Audit rules about the information on the use of semanage is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" comment="audit augenrules semanage"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" comment="audit auditctl semanage"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_restorecon:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run restorecon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_restorecon"/>
                  <description>Audit rules about the information on the use of restorecon is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" comment="audit augenrules restorecon"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" comment="audit auditctl restorecon"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_execution_chcon:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run chcon</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_execution_chcon"/>
                  <description>Audit rules about the information on the use of chcon is enabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" comment="audit augenrules chcon"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" comment="audit auditctl chcon"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_openat"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_shadow_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/shadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_shadow_open"/>
                  <description>Audit rules about the write events to /etc/shadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/shadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_openat"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_passwd_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/passwd</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_passwd_open"/>
                  <description>Audit rules about the write events to /etc/passwd</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/passwd"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_openat"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_gshadow_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/gshadow</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_gshadow_open"/>
                  <description>Audit rules about the write events to /etc/gshadow</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/gshadow"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_openat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via openat syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_openat"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_open_by_handle_at"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_etc_group_open:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify User/Group Information via open syscall - /etc/group</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_etc_group_open"/>
                  <description>Audit rules about the write events to /etc/group</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit_system"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" comment="audit rule to record write events to /etc/group"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enable Syscall Auditing</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_enable_syscall_auditing"/>
                  <description>Syscall auditing should not be disabled.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_umount:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - umount</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_umount"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" comment="audit augenrules 32-bit umount"/>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" comment="audit auditctl 32-bit umount"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_umount2:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - umount2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_umount2"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" comment="audit augenrules 32-bit umount2"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" comment="audit augenrules 64-bit umount2"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" comment="audit auditctl 32-bit umount2"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" comment="audit auditctl 64-bit umount2"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_setxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" comment="audit augenrules 32-bit setxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" comment="audit augenrules 64-bit setxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" comment="audit auditctl 32-bit setxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" comment="audit auditctl 64-bit setxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_removexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" comment="audit augenrules 32-bit removexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" comment="audit augenrules 64-bit removexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" comment="audit auditctl 32-bit removexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" comment="audit auditctl 64-bit removexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lsetxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit lsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit lsetxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit lsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit lsetxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lremovexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit lremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit lremovexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit lremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit lremovexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_lchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - lchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_lchown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" comment="audit augenrules 32-bit lchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" comment="audit augenrules 64-bit lchown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" comment="audit auditctl 32-bit lchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" comment="audit auditctl 64-bit lchown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fsetxattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" comment="audit augenrules 32-bit fsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" comment="audit augenrules 64-bit fsetxattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" comment="audit auditctl 32-bit fsetxattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" comment="audit auditctl 64-bit fsetxattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fremovexattr"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" comment="audit augenrules 32-bit fremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" comment="audit augenrules 64-bit fremovexattr"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" comment="audit auditctl 32-bit fremovexattr"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" comment="audit auditctl 64-bit fremovexattr"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchownat"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" comment="audit augenrules 32-bit fchownat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" comment="audit augenrules 64-bit fchownat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" comment="audit auditctl 32-bit fchownat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" comment="audit auditctl 64-bit fchownat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" comment="audit augenrules 32-bit fchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" comment="audit augenrules 64-bit fchown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" comment="audit auditctl 32-bit fchown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" comment="audit auditctl 64-bit fchown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchmodat"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" comment="audit augenrules 32-bit fchmodat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" comment="audit augenrules 64-bit fchmodat"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" comment="audit auditctl 32-bit fchmodat"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" comment="audit auditctl 64-bit fchmodat"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_fchmod"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" comment="audit augenrules 32-bit fchmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" comment="audit augenrules 64-bit fchmod"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" comment="audit auditctl 32-bit fchmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" comment="audit auditctl 64-bit fchmod"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_chown:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - chown</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_chown"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" comment="audit augenrules 32-bit chown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" comment="audit augenrules 64-bit chown"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" comment="audit auditctl 32-bit chown"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" comment="audit auditctl 64-bit chown"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_dac_modification_chmod:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Events that Modify the System's Discretionary Access Controls - chmod</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_dac_modification_chmod"/>
                  <description>The changing of file permissions and attributes should be audited.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" comment="audit augenrules"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" comment="audit augenrules 32-bit chmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" comment="audit augenrules 64-bit chmod"/>
                    </criteria>
                  </criteria>
                  <criteria>
                    <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" comment="audit auditctl"/>
                    <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" comment="audit auditctl 32-bit chmod"/>
                    <criteria operator="OR">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" negate="true" comment="64-bit system"/>
                      <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" comment="audit auditctl 64-bit chmod"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_augenrules:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_augenrules"/>
                  <description>Test if augenrules is enabled for audit rules.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_audit_rules_augenrules:tst:1" comment="audit augenrules"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-audit_rules_auditctl:def:1" version="1" class="compliance">
                <metadata>
                  <title>Record Any Attempts to Run semanage</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="audit_rules_auditctl"/>
                  <description>Test if auditctl is in use for audit rules.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_audit_rules_auditctl:tst:1" comment="audit auditctl"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_periodic_cron_checking:def:1" version="3" class="compliance">
                <metadata>
                  <title>Configure Periodic Execution of AIDE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_periodic_cron_checking"/>
                  <description>By default, AIDE does not install itself for periodic
      execution. Periodically running AIDE is necessary to reveal
      unexpected changes in installed files.
      </description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_crond_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_var_cron_checking:tst:1" comment="run aide with cron"/>
                    <criterion test_ref="oval:ssg-test_aide_crontabs_checking:tst:1" comment="run aide with cron.(daily|weekly)"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_check_audit_tools:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure AIDE to Verify the Audit Tools</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_check_audit_tools"/>
                  <description>The {{{ full_name }}} operating system file integrity tool must be configured to protect the integrity of the audit tools.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_auditctl:tst:1" comment="auditctl is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_auditd:tst:1" comment="auditd is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_ausearch:tst:1" comment="ausearch is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_aureport:tst:1" comment="aureport is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_autrace:tst:1" comment="autrace is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_audispd:tst:1" comment="audispd is checked in /etc/aide.conf"/>
                  <criterion test_ref="oval:ssg-test_aide_verify_augenrules:tst:1" comment="augenrules is checked in /etc/aide.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-aide_build_database:def:1" version="2" class="compliance">
                <metadata>
                  <title>Build and Test AIDE Database</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="aide_build_database"/>
                  <description>The aide database must be initialized.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" comment="Aide is installed"/>
                  <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1"/>
                  <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_umask_etc_profile:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure the Default Umask is Set Correctly in /etc/profile</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_umask_etc_profile"/>
                  <description>The default umask for all users should be set correctly</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_umask_etc_login_defs:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure the Default Umask is Set Correctly in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_umask_etc_login_defs"/>
                  <description>The default umask for all users specified in /etc/login.defs</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" comment="Get value of var_accounts_user_umask variable as octal number"/>
                  <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_tmout:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Interactive Session Timeout</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_tmout"/>
                  <description>Checks interactive shell timeout</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_etc_profile_tmout:tst:1" comment="TMOUT value in /etc/profile &lt;= var_accounts_tmout"/>
                  <criterion test_ref="oval:ssg-test_etc_profiled_tmout:tst:1" comment="TMOUT value in /etc/profile.d/*.sh &lt;= var_accounts_tmout"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_root_path_dirs_no_write:def:1" version="2" class="compliance">
                <metadata>
                  <title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_root_path_dirs_no_write"/>
                  <description>Check each directory in root's path and make use it does
      not grant write permission to group and other</description>
                </metadata>
                <criteria comment="Check that write permission to group and other in root's path is denied">
                  <criterion test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" comment="Check for write permission to group and other in root's path"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Polyinstantiation of /var/tmp Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_polyinstantiated_var_tmp"/>
                  <description/>
                </metadata>
                <criteria comment="Check Polyinstantiation of /tmp Directories">
                  <criterion test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1" comment="Check that /var/tmp/tmp-inst exists and has mode 000"/>
                  <criterion test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" comment="Check configuration of /var/tmp in /etc/security/namespace.conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_polyinstantiated_tmp:def:1" version="1" class="compliance">
                <metadata>
                  <title>Configure Polyinstantiation of /tmp Directories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_polyinstantiated_tmp"/>
                  <description/>
                </metadata>
                <criteria comment="Check Polyinstantiation of /tmp Directories">
                  <criterion test_ref="oval:ssg-test_tmp_inst:tst:1" comment="Check that /tmp/tmp-inst exists and has mode 000"/>
                  <criterion test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1" comment="Check configuration of /tmp in /etc/security/namespace.conf file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Lockout Time for Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_unlock_time"/>
                  <description>The unlock time after number of failed logins should be set correctly.</description>
                </metadata>
                <criteria operator="OR">
                  <criteria comment="When ext var unlock_time is zero, all configs must be zero or never">
                    <criterion test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" comment="Is ext var unlock time zero?"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1" comment="Test if config is zero or never"/>
                  </criteria>
                  <criteria comment="When ext var unlock_time is not zero, configs should be zero or never, or greater than or equal the external variable">
                    <criterion test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" negate="true" comment="Is ext var unlock time different than zero?"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1" comment="Test if config is greater than or equals the ext var unlock time"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Interval For Counting Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_interval"/>
                  <description>The number of allowed failed logins should be set correctly.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" comment="preauth default is set to 900"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" comment="authfail default is set to 900"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" comment="authfail default is set to 900"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" comment="preauth default is set to 900"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1" comment="account requires pam_faillock.so in /etc/pam.d/password-auth"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1" comment="account requires pam_faillock.so in /etc/pam.d/system-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" version="1" class="compliance">
                <metadata>
                  <title>Enforce pam_faillock for Local Accounts Only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_enforce_local"/>
                  <description>Check presence of local_users_only in /etc/security/faillock.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 1 extra definitions.">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_faillock:def:1" comment="extend_definition added explicitly"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1" comment="Check that /etc/security/faillock.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" version="4" class="compliance">
                <metadata>
                  <title>Configure the root Account for Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny_root"/>
                  <description>The root account should be configured to deny access after the number of defined
      failed attempts has been reached.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
                  <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in system-auth"/>
                  <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
                  <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" comment="pam_faillock.so authfail deny_root value set in password-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" version="4" class="compliance">
                <metadata>
                  <title>Set Deny For Failed Password Attempts</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_passwords_pam_faillock_deny"/>
                  <description>The number of allowed failed logins should be set correctly.</description>
                </metadata>
                <criteria comment="Checks common to both scenarios">
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" comment="pam_faillock.so preauth silent set in system-auth"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" comment="pam_faillock.so set in account phase of system-auth"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" comment="pam_faillock.so preauth silent set in password-auth"/>
                  <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" comment="pam_faillock.so set in account phase of password-auth"/>
                  <criteria>
                    <criteria operator="OR" comment="system-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix even with lines skipped"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix with either sufficient or default=ignore"/>
                    </criteria>
                    <criteria operator="OR" comment="password-auth">
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" comment="Perform check if pam_faillock authfail follows pam_unix even with lines skipped"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" comment="pam_faillock.so authfail deny value set in password-auth"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_warn_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Warning Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_warn_age_login_defs"/>
                  <description>The password expiration warning age should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of Password Hashing Rounds - system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_rounds_system_auth"/>
                  <description>The number of rounds for password hashing should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="Check if rounds option of pam_unix is as expected">
                  <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" comment="The value of rounds is set correctly in pam_unix.so"/>
                  <criteria comment="The value of rounds is no set, in this case the system default is used">
                    <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" comment="The default value of rounds is used in pam_unix.so"/>
                    <criterion test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" comment="The target value of rounds is the default"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" version="1" class="compliance">
                <metadata>
                  <title>Set number of Password Hashing Rounds - password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_rounds_password_auth"/>
                  <description>The number of rounds for password hashing should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="Check if rounds option of pam_unix is as expected">
                  <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" comment="The value of rounds is set correctly in pam_unix.so"/>
                  <criteria comment="The value of rounds is no set, in this case the system default is used">
                    <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" comment="The default value of rounds is used in pam_unix.so"/>
                    <criterion test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" comment="The target value of rounds is the default"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_unix_remember:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_unix_remember"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria operator="OR" comment="remember parameter of pam_unix.so or pam_pwhistory.so is set correctly">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" comment="remember parameter of pam_unix.so is set correctly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_ucredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_ucredit"/>
                  <description>The password ucredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for ucredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_retry:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_retry"/>
                  <description>The password retry should meet minimum requirements</description>
                </metadata>
                <criteria comment="Conditions for retry are satisfied">
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" comment="pam_pwquality system-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check pam_pwquality Existence in system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwquality"/>
                  <description>Check that pam_pwquality.so exists in system-auth</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality:tst:1" comment="Conditions for pam_pwquality are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse: system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwhistory_remember_system_auth"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria comment="remember parameter of pam_pwhistory.so is set correctly">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" version="2" class="compliance">
                <metadata>
                  <title>Limit Password Reuse: password-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_pwhistory_remember_password_auth"/>
                  <description>The passwords to remember should be set correctly.</description>
                </metadata>
                <criteria comment="remember parameter of pam_pwhistory.so is set correctly in password-auth">
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" comment="remember parameter of pam_pwhistory.so is set correctly in password-auth"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_ocredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Special Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_ocredit"/>
                  <description>The password ocredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for ocredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_minlen:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Length</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_minlen"/>
                  <description>The password minlen should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for minlen are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_minclass:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Different Categories</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_minclass"/>
                  <description>The password minclass should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for minclass are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_maxrepeat:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Maximum Consecutive Repeating Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_maxrepeat"/>
                  <description>The password maxrepeat should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for maxrepeat are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_maxclassrepeat"/>
                  <description>The password maxclassrepeat should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for maxclassrepeat are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_lcredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_lcredit"/>
                  <description>The password lcredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for lcredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_faillock:def:1" version="1" class="compliance">
                <metadata>
                  <title>Check pam_faillock Existence in system-auth</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_faillock"/>
                  <description>Check that pam_faillock.so exists in system-auth</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1" comment="Conditions for pam_faillock are satisfied"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_enforce_root:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Enforce for root User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_enforce_root"/>
                  <description>Check presence of enforce_for_root in /etc/security/pwquality.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 1 extra definitions.">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="extend_definition added explicitly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" comment="Check that /etc/security/pwquality.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_enforce_local:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_enforce_local"/>
                  <description>Check presence of local_users_only in /etc/security/pwquality.conf</description>
                </metadata>
                <criteria comment="Test conditions - presence of the file plus 1 extra definitions.">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="extend_definition added explicitly"/>
                  <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" comment="Check that /etc/security/pwquality.conf contains a line with certain text"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_difok:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Different Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_difok"/>
                  <description>The password difok should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for difok are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_dictcheck:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_dictcheck"/>
                  <description>The password dictcheck should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for dictcheck are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_pam_dcredit:def:1" version="3" class="compliance">
                <metadata>
                  <title>Ensure PAM Enforces Password Requirements - Minimum Digit Characters</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_pam_dcredit"/>
                  <description>The password dcredit should meet minimum requirements</description>
                </metadata>
                <criteria comment="conditions for dcredit are satisfied">
                  <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" comment="pwquality.so exists in system-auth"/>
                  <criterion test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" comment="pwquality.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_minlen_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Minimum Length in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_minlen_login_defs"/>
                  <description>The password minimum length should be set appropriately.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_pass_min_len:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify All Account Password Hashes are Shadowed with SHA512</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_all_shadowed_sha512"/>
                  <description>All password hashes should be shadowed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" comment="password hashes are shadowed using sha512"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_password_all_shadowed:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify All Account Password Hashes are Shadowed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_password_all_shadowed"/>
                  <description>All password hashes should be shadowed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1" comment="password hashes are shadowed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_no_uid_except_zero:def:1" version="1" class="compliance">
                <metadata>
                  <title>Verify Only Root Has UID 0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_no_uid_except_zero"/>
                  <description>Only the root account should be assigned a user id of 0.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1" comment="tests that there are no accounts with UID 0 except root in the /etc/passwd file"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_minimum_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Minimum Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_minimum_age_login_defs"/>
                  <description>The minimum password age policy should be set appropriately.</description>
                </metadata>
                <criteria comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
                  <criterion test_ref="oval:ssg-test_pass_min_days:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_maximum_age_login_defs:def:1" version="3" class="compliance">
                <metadata>
                  <title>Set Password Maximum Age</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_maximum_age_login_defs"/>
                  <description>The maximum password age policy should meet minimum requirements.</description>
                </metadata>
                <criteria comment="The value PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
                  <criterion test_ref="oval:ssg-test_pass_max_days:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" version="1" class="compliance">
                <metadata>
                  <title>Limit the Number of Concurrent Login Sessions Allowed Per User</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_max_concurrent_login_sessions"/>
                  <description>The maximum number of concurrent login sessions per user should meet
      minimum requirements.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_limitsd_maxlogins:tst:1" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf"/>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" negate="true" comment="the value maxlogins should not be set at all in /etc/security/limits.d/*.conf"/>
                    <criterion test_ref="oval:ssg-test_maxlogins:tst:1" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_logon_fail_delay:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure the Logon Failure Delay is Set Correctly in login.defs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_logon_fail_delay"/>
                  <description>The delay between failed authentication attempts should be
      set for all users specified in /etc/login.defs</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_have_homedir_login_defs:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure Home Directories are Created for New Users</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_have_homedir_login_defs"/>
                  <description>CREATE_HOME should be enabled</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" comment="Check CREATE_HOME in /etc/login.defs"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-accounts_authorized_local_users:def:1" version="1" class="compliance">
                <metadata>
                  <title>Only Authorized Local User Accounts Exist on Operating System</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="accounts_authorized_local_users"/>
                  <description>Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" comment="only root user and explicitly authorized users are allowed in /etc/passwd"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_unique_name:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Accounts on the System Have Unique Names</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_unique_name"/>
                  <description>All accounts on the system should have unique names for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate user name entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_unique_id:def:1" version="1" class="compliance">
                <metadata>
                  <title>Ensure All Accounts on the System Have Unique User IDs</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_unique_id"/>
                  <description>All accounts on the system should have unique IDs for proper accountability.</description>
                </metadata>
                <criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
                  <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-account_disable_post_pw_expiration:def:1" version="2" class="compliance">
                <metadata>
                  <title>Set Account Expiration Following Inactivity</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="ssg" ref_id="account_disable_post_pw_expiration"/>
                  <description>The accounts should be configured to expire automatically following password expiration.</description>
                </metadata>
                <criteria comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
                  <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:variable_test id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" comment="Test the retrieved /etc/init.d/functions umask value(s) match the var_umask_for_daemons requirement">
                <ind-def:object object_ref="oval:ssg-obj_umask_for_daemons:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_umask_for_daemons:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups start parameter is less than or equal to 10">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups rate parameter is greater than or equal to 30">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" comment="SSH MaxStartups full parameter is less than or equal to 100">
                <ind-def:object object_ref="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" comment="Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement">
                <ind-def:object object_ref="oval:ssg-obj_accounts_umask_etc_profile:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_accounts_umask_etc_profile:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" comment="Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement">
                <ind-def:object object_ref="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1"/>
              </ind-def:variable_test>
              <lin-def:partition_test id="oval:ssg-testvar_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testvar_log_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_log_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountvar_log_audit_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testusr_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/usr on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountusr_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testtmp_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/tmp on own partition">
                <lin-def:object object_ref="oval:ssg-object_mounttmp_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testsrv_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/srv on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountsrv_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testopt_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/opt on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountopt_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testhome_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/home on own partition">
                <lin-def:object object_ref="oval:ssg-object_mounthome_own_partition:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-testboot_partition:tst:1" version="1" check_existence="all_exist" check="all" comment="/boot on own partition">
                <lin-def:object object_ref="oval:ssg-object_mountboot_own_partition:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of localpkg_gpgcheck in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" comment="Check WRLinux8 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" check_existence="none_exist" check="all" comment="query /proc/net/wireless">
                <ind-def:object object_ref="oval:ssg-object_wireless_disable_interfaces:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" check_existence="none_exist" check="all" comment="virtual consoles /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_virtual_consoles_etc_securetty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpmverifyfile_test id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check_existence="none_exist" check="all" comment="mode of all files matches local rpm database">
                <lin-def:object object_ref="oval:ssg-object_files_fail_mode:obj:1"/>
              </lin-def:rpmverifyfile_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD only exists for vdsm user in /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check that /tmp-inst exists and has mode 000">
                <unix-def:object object_ref="oval:ssg-obj_var_tmp_tmp_inst:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_var_tmp_tmp_inst:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file">
                <ind-def:object object_ref="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" check="all" comment="Check if removable partition variable value represents CD/DVD drive">
                <ind-def:object object_ref="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1"/>
              </ind-def:variable_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /var optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /var/log optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /var/log/audit optional yes">
                <lin-def:object object_ref="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:variable_test id="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" version="1" check="all" comment="Check if external variable unlock time is never">
                <ind-def:object object_ref="oval:ssg-object_var_faillock_unlock_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_faillock_unlock_time_is_never:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock delay cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_user_change_lock_delay_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change screensaver idle delay">
                <ind-def:object object_ref="oval:ssg-obj_user_change_idle_delay_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_use_pty_sudoers:tst:1" version="1" check="all" comment="use_pty exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_use_pty_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" check="all" comment="check /etc/pam.d/su for correct setting">
                <ind-def:object object_ref="oval:ssg-object_use_pam_wheel_for_su:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" check="all" comment="Check the usbguard rules in either /etc/usbguard/rules.conf or /etc/usbguard/rules.d/ contain at least one non whitespace character and exists">
                <ind-def:object object_ref="oval:ssg-obj_usbguard_rules_nonempty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family">
                <ind-def:object object_ref="oval:ssg-object_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_family:ste:1"/>
              </ind-def:family_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" comment="Check Ubuntu">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /tmp optional yes">
                <lin-def:object object_ref="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <unix-def:file_test id="oval:ssg-test_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check that /tmp/tmp-inst exists and has mode 000">
                <unix-def:object object_ref="oval:ssg-obj_tmp_inst:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_tmp_inst:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" check="all" comment="Check configuration of /tmp in /etc/security/namespace.conf file">
                <ind-def:object object_ref="oval:ssg-obj_tmp_in_namespace_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" check="at least one" comment="Test that the dnf-automatic timer is running">
                <lin-def:object object_ref="oval:ssg-obj_timer_running_dnf-automatic:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_timer_running_dnf-automatic:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <unix-def:file_test id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /sys/firmware/opal exists">
                <unix-def:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
              </unix-def:file_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_x86_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_x86_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" check="all" comment="32 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_x86:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_x86:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_s390_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_s390_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppc_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppc_64:ste:1"/>
              </unix-def:uname_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_aarch_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_aarch_64:ste:1"/>
              </unix-def:uname_test>
              <ind-def:variable_test id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" check="at least one" comment="tests if var_system_crypto_policy is set to FIPS">
                <ind-def:object object_ref="oval:ssg-obj_system_crypto_policy_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_system_crypto_policy_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_system_auth_pam_unix_rounds:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_system_auth_pam_unix_rounds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if value of var_password_pam_unix_rounds is the system's default">
                <ind-def:object object_ref="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1"/>
              </ind-def:variable_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter vm.mmap_min_addr set to 65536">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter user.max_user_namespaces set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.router_solicitations set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.max_addresses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.disable_ipv6 set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.autoconf set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_rtr_pref set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_pinfo set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra_defrtr set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.router_solicitations set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.max_addresses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.autoconf set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_rtr_pref set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_pinfo set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv6.conf.all.accept_ra_defrtr set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.tcp_syncookies set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.ip_local_port_range set to 32768 65535">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.ip_forward set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.rp_filter set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter net.core.bpf_jit_harden set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.yama.ptrace_scope set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.unprivileged_bpf_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.sysrq set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.randomize_va_space set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.pid_max set to 65536">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_event_paranoid set to 2">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.modules_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.kptr_restrict set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.kexec_load_disabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.dmesg_restrict set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.core_pattern set to |/bin/false">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.suid_dumpable set to 0">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_symlinks set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter fs.protected_hardlinks set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1"/>
              </unix-def:sysctl_test>
              <unix-def:sysctl_test id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter crypto.fips_enabled set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1"/>
              </unix-def:sysctl_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" check="all" comment="check NOZEROCONF=yes in /etc/sysconfig/network">
                <ind-def:object object_ref="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" check_existence="none_exist" check="all" comment="SYS_UID_MIN not defined in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" check_existence="none_exist" check="all" comment="SYS_UID_MAX not defined in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_targetpw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_runaspw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure invoking user's password for privilege escalation when using sudo">
                <ind-def:object object_ref="oval:ssg-object_test_sudoers_rootpw_config:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no command in user spec contains negation">
                <ind-def:object object_ref="oval:ssg-object_sudoers_no_command_negation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no command in user spec is without any argument">
                <ind-def:object object_ref="oval:ssg-object_sudoers_explicit_command_args:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" comment="vm.mmap_min_addr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" comment="user.max_user_namespaces static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.max_addresses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.autoconf static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.default.accept_ra static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.max_addresses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.autoconf static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.tcp_syncookies static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.ip_local_port_range static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.ip_forward static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.send_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.rp_filter static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.log_martians static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.send_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.rp_filter static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.log_martians static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" comment="net.core.bpf_jit_harden static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.yama.ptrace_scope static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.unprivileged_bpf_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.sysrq static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.randomize_va_space static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.pid_max static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_event_paranoid static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_event_max_sample_rate static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.perf_cpu_time_max_percent static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.modules_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.kptr_restrict static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.kexec_load_disabled static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.exec-shield static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.dmesg_restrict static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel.core_pattern static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.suid_dumpable static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_symlinks static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" comment="fs.protected_hardlinks static configuration">
                <ind-def:object object_ref="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" comment="vm.mmap_min_addr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" comment="user.max_user_namespaces static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.default.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.default.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.default.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.default.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" comment="net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" comment="net.ipv6.conf.all.router_solicitations static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" comment="net.ipv6.conf.all.max_addresses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" comment="net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" comment="net.ipv6.conf.all.autoconf static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_rtr_pref static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_pinfo static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" comment="net.ipv6.conf.all.accept_ra_defrtr static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" comment="net.ipv4.tcp_syncookies static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" comment="net.ipv4.ip_local_port_range static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" comment="net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" comment="net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" comment="net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" comment="net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" comment="net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" comment="net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" comment="net.core.bpf_jit_harden static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" comment="kernel.yama.ptrace_scope static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" comment="kernel.unprivileged_bpf_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" check="all" comment="kernel.sysrq static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" comment="kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" check="all" comment="kernel.pid_max static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" comment="kernel.perf_event_paranoid static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" comment="kernel.perf_event_max_sample_rate static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" comment="kernel.perf_cpu_time_max_percent static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" comment="kernel.modules_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" comment="kernel.kptr_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" comment="kernel.kexec_load_disabled static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" comment="kernel.dmesg_restrict static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" check="all" comment="kernel.core_pattern static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" comment="fs.suid_dumpable static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" comment="fs.protected_symlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" comment="fs.protected_hardlinks static configuration in /etc/sysctl.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" check="all" comment="tests the value of user setting in SSSD config files">
                <ind-def:object object_ref="oval:ssg-obj_sssd_user_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_user_value:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of offline_credentials_expiration setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_offline_cred_expiration:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of memcache_timeout setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_memcache_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_memcache_timeout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of pam_cert_auth setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_enable_smartcards:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" check="all" comment="tests the presence of '^\[certmap\/.+\/.+\]$' setting in the /etc/sssd/sssd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_sssd_enable_certmap:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_sssd_conf_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing if /etc/sssd/sssd.conf exists">
                <unix-def:object object_ref="oval:ssg-object_sssd_conf_exists:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" check_existence="all_exist" check="all" comment="test the value of         certificate_verification in sssd configuration">
                <ind-def:object object_ref="oval:ssg-obj_sssd_certificate_verification:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sssd_certificate_verification:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of X11UseLocalhost setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of X11UseLocalhost setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11UseLocalhost setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_x11_use_localhost:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_x11_use_localhost:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of UsePrivilegeSeparation setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_use_priv_separation:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_use_priv_separation:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of match setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_verbose:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of LogLevel setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_loglevel_info:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_loglevel_info:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_set_keepalive_0:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_set_keepalive_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" check="all" comment="Verify if Value of sshd_required is the default">
                <ind-def:object object_ref="oval:ssg-object_sshd_requirement_unknown:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_requirement_unset:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as required">
                <ind-def:object object_ref="oval:ssg-object_sshd_required:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_required:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of RekeyLimit setting in the  file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_rekey_limit:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PrintLastLog setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PrintLastLog setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_print_last_log_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_print_last_log:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PrintLastLog setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_print_last_log:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_print_last_log:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_sshd_not_required:tst:1" version="1" check="all" comment="Verify if Profile set Value sshd_required as not required">
                <ind-def:object object_ref="oval:ssg-object_sshd_not_required:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_not_required:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_max_sessions:tst:1" version="1" check_existence="all_exist" check="all" comment="maxsessions is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_max_sessions:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxsessions_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxsessions_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" check_existence="all_exist" check="all" comment="maxauthtries is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_max_auth_tries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxauthtries_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxauthtries_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" check="all" comment="tests the presence of 'Include /etc/ssh/sshd_config.d/*.conf' setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_includes_config_files:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" check_existence="all_exist" check="all" comment="timeout is configured">
                <ind-def:object object_ref="oval:ssg-object_sshd_idle_timeout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_timeout_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_x11_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Banner setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_warning_banner:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_warning_banner:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of StrictModes setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of StrictModes setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of StrictModes setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_strictmodes:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_strictmodes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_enable_gssapi_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitUserEnvironment setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitUserEnvironment setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_do_not_permit_user_env:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_x11_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreUserKnownHosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_user_known_hosts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AllowTcpForwarding setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_password_login:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_password_login:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_root_login:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_root_login:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" check_existence="none_exist" check="all" comment="Tests the value of the RhostsRSAAuthentication[\s]*(&lt;:nocomment:&gt;*) setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of IgnoreRhosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of IgnoreRhosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_rhosts:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_rhosts:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PubkeyAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_pubkey_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of KerberosAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of KerberosAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of KerberosAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_kerb_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_kerb_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GSSAPIAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_gssapi_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_empty_passwords:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_empty_passwords:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_disable_compression:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Compression setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_disable_compression:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_disable_compression:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the value of the ClientAliveCountMax setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_sshd_clientalivecountmax:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sshd_clientalivecountmax:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" check_existence="all_exist" check="all" comment="sshd uses protocol 2">
                <ind-def:object object_ref="oval:ssg-object_sshd_allow_only_protocol2:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /srv optional yes">
                <lin-def:object object_ref="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_snmp_versions:tst:1" version="1" check_existence="none_exist" check="all" comment="Check snmpd configuration">
                <ind-def:object object_ref="oval:ssg-object_snmp_versions:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_snmp_default_communities:tst:1" version="1" check_existence="none_exist" check="all" comment="Check snmpd configuration">
                <ind-def:object object_ref="oval:ssg-object_snmp_default_communities:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is required in /etc/pam.d/system-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_required_system_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is required in /etc/pam.d/smartcard-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_required_smartcard_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Test smartcard authentication is enabled in /etc/pam.d/system-auth file">
                <ind-def:object object_ref="oval:ssg-object_smart_card_enabled_system_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 12">
                <lin-def:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" comment="sles-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" comment="sled-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" comment="sles-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" comment="sled-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl7:tst:1" version="1" check="all" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_sl7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl6:tst:1" version="1" check="all" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sl6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl6:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;0, SYS_UID_MIN&gt; system UIDs having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;SYS_UID_MIN, SYS_UID_MAX&gt; system UIDS having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_sys_uid_min:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" check_existence="any_exist" check="all" state_operator="OR" comment="&lt;0, UID_MIN - 1&gt; system UIDs having shell set">
                <ind-def:object object_ref="oval:ssg-object_etc_passwd_entries:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_less_than_zero:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package usbguard is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package systemd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package syslogng is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_syslogng_package_syslogng_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package rsyslog is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package sssd-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openssh-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_usbguard:tst:1" version="1" check="at least one" comment="Test that the usbguard service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_usbguard:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_usbguard:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_syslogng:tst:1" version="1" check="at least one" comment="Test that the syslogng service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_syslogng:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_syslogng:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_rsyslog:tst:1" version="1" check="at least one" comment="Test that the rsyslog service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_rsyslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_rsyslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_rngd:tst:1" version="1" check="at least one" comment="Test that the rngd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_rngd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_rngd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_pcscd:tst:1" version="1" check="at least one" comment="Test that the pcscd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_pcscd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_pcscd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ntpd:tst:1" version="1" check="at least one" comment="Test that the ntpd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ntpd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ntpd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ntp:tst:1" version="1" check="at least one" comment="Test that the ntp service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ntp:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ntp:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_iptables:tst:1" version="1" check="at least one" comment="Test that the iptables service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_iptables:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_iptables:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_ip6tables:tst:1" version="1" check="at least one" comment="Test that the ip6tables service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_ip6tables:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_ip6tables:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_firewalld:tst:1" version="1" check="at least one" comment="Test that the firewalld service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_firewalld:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_firewalld:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_crond:tst:1" version="1" check="at least one" comment="Test that the crond service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_crond:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_crond:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_cron:tst:1" version="1" check="at least one" comment="Test that the cron service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_cron:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_cron:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_chronyd:tst:1" version="1" check="at least one" comment="Test that the chronyd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_chronyd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_chronyd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_running_auditd:tst:1" version="1" check="at least one" comment="Test that the auditd service is running">
                <lin-def:object object_ref="oval:ssg-obj_service_running_auditd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_running_auditd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package rsync-daemon is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rng-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package pcsc-lite is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the systemd-coredump service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_systemd-coredump:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_systemd-coredump:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_syslog:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the syslog service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_syslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_syslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_sssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the sssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_sssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_sssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_sshd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the sshd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_sshd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_sshd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rsyncd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rsyncd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rsyncd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcsvcgssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcidmapd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcidmapd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcidmapd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the rpcgssd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_rpcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_rpcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the nfslock service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_nfslock:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_nfslock:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the nfs-server service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_nfs-server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_nfs-server:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_netfs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the netfs service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_netfs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_netfs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the debug-shell service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_debug-shell:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_debug-shell:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the bluetooth service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_bluetooth:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_bluetooth:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_autofs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the autofs service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_autofs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_autofs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_not_running_atd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the atd service is not running">
                <lin-def:object object_ref="oval:ssg-obj_service_not_running_atd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_not_running_atd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package netfs is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service systemd-coredump is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service syslog is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service sssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service sshd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rsyncd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcsvcgssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcidmapd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service rpcgssd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service nfslock is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service nfs-server is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service netfs is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service debug-shell is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service bluetooth is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service autofs is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:systemdunitproperty_test id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" check_existence="any_exist" check="all" comment="Test that the property LoadState from the service atd is masked">
                <lin-def:object object_ref="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_service_loadstate_is_masked_atd:ste:1"/>
              </lin-def:systemdunitproperty_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables-ipv6 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package firewalld is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package systemd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cronie is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cron is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package bluez is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package autofs is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package at is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_service_atd_package_at_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" check_existence="all_exist" check="all" comment="serial ports /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_serial_ports_etc_securetty:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file">
                <ind-def:object object_ref="oval:ssg-obj_selinux_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_selinux_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_grub_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/grub.d fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_grub_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_grub2_cfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_enforcing:tst:1" version="1" check_existence="all_exist" check="all" comment="/selinux/enforce is 1">
                <ind-def:object object_ref="oval:ssg-object_selinux_enforcing:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="unlabeled_t in /dev">
                <lin-def:object object_ref="oval:ssg-object_selinux_dev_unlabeled_t:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_dev_unlabeled_t:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="device_t in /dev">
                <lin-def:object object_ref="oval:ssg-object_selinux_dev_device_t:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_dev_device_t:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_selinux_default_grub:tst:1" version="1" check_existence="none_exist" check="all" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found">
                <ind-def:object object_ref="oval:ssg-object_selinux_default_grub:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:selinuxsecuritycontext_test id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" check_existence="any_exist" check="none satisfy" comment="none satisfy unconfined_service_t in /proc">
                <lin-def:object object_ref="oval:ssg-object_selinux_confinement_of_daemons:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_selinux_confinement_of_daemons:ste:1"/>
              </lin-def:selinuxsecuritycontext_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver mode is blank">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_mode_blank:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock is enabled">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock delay setting is correct">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_delay_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_screensaver_lock_delay_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock is set correctly">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_lock_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver idle delay setting is correct">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_delay_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_screensaver_idle_delay_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver idle delay is configured">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="idle delay is configured">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver user info is disabled">
                <ind-def:object object_ref="oval:ssg-obj_screensaver_disable_user_info:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:sysctl_test id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" comment="kernel runtime parameter kernel.exec-shield set to 1">
                <unix-def:object object_ref="oval:ssg-object_sysctl_kernel_exec_shield:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_sysctl_kernel_exec_shield:ste:1"/>
              </unix-def:sysctl_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" check="all" comment="tests the DefaultNetstreamDriverCAFile configuration">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" check="all" comment="tests the omfwd action configuration">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_remote_tls:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rsyslog_remote_tls:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" check_existence="none_exist" check="all" comment="Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp">
                <ind-def:object object_ref="oval:ssg-object_rsyslog_nolisten:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" check_existence="all_exist" check="all" comment="Permissions of system log files are correct">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_permissions:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_permissions:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" check_existence="all_exist" check="all" comment="System log files are owned by the appropriate user">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_ownership:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_ownership:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" check_existence="all_exist" check="all" comment="System log files are owned by the appropriate group">
                <unix-def:object object_ref="oval:ssg-object_rsyslog_files_groupownership:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_rsyslog_files_groupownership:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1" version="1" check_existence="none_exist" check="all" comment="test if system-wide files have root permissions">
                <unix-def:object object_ref="oval:ssg-root_permissions_for_system_wide_library_files:obj:1"/>
              </unix-def:file_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhosp13_release:tst:1" version="1" check="all" comment="OpenStack is version 13">
                <lin-def:object object_ref="oval:ssg-obj_rhosp13_release:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhosp13_release:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhosp10_release:tst:1" version="1" check="all" comment="OpenStack is version 10">
                <lin-def:object object_ref="oval:ssg-obj_rhosp10_release:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhosp10_release:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" comment="rhevm4-appliance is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 9">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 8">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel9:tst:1" version="1" check="all" comment="redhat-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel9:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" comment="redhat-release is version 8.9">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" comment="redhat-release is version 8.8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" comment="redhat-release is version 8.7">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" comment="redhat-release is version 8.6">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" comment="redhat-release is version 8.5">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" comment="redhat-release is version 8.4">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" comment="redhat-release is version 8.3">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" comment="redhat-release is version 8.2">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" comment="redhat-release is version 8.1">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" comment="redhat-release is version 8.10">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" comment="redhat-release is version 8.0">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8:tst:1" version="1" check="all" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" comment="redhat-release-workstation is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" comment="redhat-release-server is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" comment="redhat-release-computenode is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" comment="redhat-release-client is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos:tst:1" version="1" check="all" comment="os-release is rhcos">
                <ind-def:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" comment="rhcoreos is version 4">
                <ind-def:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_requiretty_sudoers:tst:1" version="1" check="all" comment="requiretty exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_requiretty_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that the systemd rescue.service is in the runlevel1.target">
                <ind-def:object object_ref="oval:ssg-obj_require_rescue_service_runlevel1:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_rescue_service:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd rescue.service to ensure that a   password must be entered to access single user mode">
                <ind-def:object object_ref="oval:ssg-obj_require_rescue_service:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that the systemd emergency.service is in the emergency.target">
                <ind-def:object object_ref="oval:ssg-obj_require_emergency_service_emergency:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_require_emergency_service:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests that     /usr/lib/systemd/systemd-sulogin-shell     was not removed from the default systemd emergency.service to ensure that a   password must be entered to access single user mode">
                <ind-def:object object_ref="oval:ssg-obj_require_emergency_service:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if expected removable partitions truly exist on the system">
                <unix-def:object object_ref="oval:ssg-object_removable_partition_doesnt_exist:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensures system configured to export logs to remote host">
                <ind-def:object object_ref="oval:ssg-object_remote_loghost_rsyslog_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensures system configured to export logs to remote host">
                <ind-def:object object_ref="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" check="all" comment="remote method daemon monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_daemon:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" check="all" comment="remote method authpriv monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" check="all" comment="remote method auth monitoring configured in rsyslog'">
                <ind-def:object object_ref="oval:ssg-obj_remote_method_monitoring_auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:interface_test id="oval:ssg-test_promisc_interfaces:tst:1" version="1" check="all" comment="check all network interfaces for PROMISC flag">
                <unix-def:object object_ref="oval:ssg-object_promisc_interfaces:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_promisc:ste:1"/>
              </unix-def:interface_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for s390x architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Check if kernel nvr arch is 64-bit">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" check="all" comment="Check for CPU flag lm">
                <ind-def:object object_ref="oval:ssg-object_proc_cpuinfo_64_bit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_cpuinfo_64_bit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from modifying user-administration-disabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of system geolocation">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_sys_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" check_existence="all_exist" check="all" comment="blank screensaver cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_screensaver_lock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from modifying removal-action">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_removal-action:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" comment="prevent user from disabling remote access encryption">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" comment="prevent user from disabling remote access credential requirements">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_remote_access_creds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of power settings">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_power_setting_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver lock delay cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_lock_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_info_change:tst:1" version="1" check_existence="all_exist" check="all" comment="screensaver prevent user from changing">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_info_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing autorun setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_autorun:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing automount-open setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent user from changing automount setting">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_gnome_automount:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of wifi notification capability">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of wifi creation capability">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI restart and shutdown buttons cannot be enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of ctrl-alt-del keys">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI user list cannot be enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_disable_user_list:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI smartcard authentication cannot be disabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_disable_smartcard:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Prevent enabling of clock geolocation">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_clock_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change screensaver idle delay">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_idle_delay:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change idle_activation_locked">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot change idle_activation_enabled">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" comment="user cannot enable thumbnailers ">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner cannot be changed by user">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_banner_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" check_existence="all_exist" check="all" comment="number of login attempts cannot be changed">
                <ind-def:object object_ref="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" check="all" comment="Check if root has the correct mail alias.">
                <ind-def:object object_ref="oval:ssg-obj_root_mail_alias:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_root_mail_alias:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_perms_lib_files:tst:1" version="1" check_existence="none_exist" check="all" comment="library files go-w">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_lib_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_perms_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="library directories go-w">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_lib_dir:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_perms_binary_files:tst:1" version="1" check_existence="none_exist" check="all" comment="binary files go-w">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_binary_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" check_existence="all_exist" check="all" comment="system.map files readable only by root">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_systemmap_files:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_owner_systemmap:ste:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_systemmap:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_ucredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_retry_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_ocredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_minlen:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_minlen:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_minclass:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_minclass:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_maxrepeat:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_maxclassrepeat:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_lcredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_difok:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_difok:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_dictcheck:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" check="all" comment="check the configuration of /etc/security/pwquality.conf">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_pam_dcredit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_pam_pwquality:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_password_pam_pwquality:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if rounds attribute of pam_unix.so is set correctly in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_auth_pam_unix_rounds:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if rounds attribute of pam_unix.so is not set in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_password_auth_pam_unix_rounds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if value of var_password_pam_unix_rounds is the system's default">
                <ind-def:object object_ref="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_warn_age:tst:1" version="1" check="all" comment="The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_warn_age_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_warn_age_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_min_len:tst:1" version="1" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_min_len_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_min_len_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_min_days:tst:1" version="1" check="all" comment="The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_min_days_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_min_days_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_pass_max_days:tst:1" version="1" check="all" comment="The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_pass_max_days_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_pass_max_days_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_unix_sha512:tst:1" version="1" check="all" comment="check /etc/pam.d/system-auth for correct settings">
                <ind-def:object object_ref="oval:ssg-object_pam_unix_sha512:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" check="at least one" comment="Test ocsp_on in /etc/pam_pkcs11/pkcs11.conf">
                <ind-def:object object_ref="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check maximum failed login attempts allowed in /etc/pam.d/system-auth (authfail)">
                <ind-def:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check maximum failed login attempts allowed in /etc/pam.d/password-auth (authfail)">
                <ind-def:object object_ref="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package xorg-x11-server-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package vsftpd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vsftpd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package vsftpd is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vsftpd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package vim-enhanced is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package usbguard is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_usbguard_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tuned_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package tuned is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tuned_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tmux_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package tmux is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tmux_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package telnetd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_telnetd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package telnetd-ssl is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_tar_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package tar is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_tar_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package syslogng is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_syslogng_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sudo_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package sudo is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package sssd-ipa is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package setroubleshoot-plugins is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package sendmail is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_sendmail_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_screen_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package screen is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_screen_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package scap-security-guide is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package samba-common is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_samba-common_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rsyslog_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rsyslog-gnutls is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rng-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rng-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_rear_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package rear is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_rear_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_prelink_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package prelink is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_prelink_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package policycoreutils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_policycoreutils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package pcsc-lite is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package pam_ldap is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_pam_ldap_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openssl-pkcs11 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openssh-server is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssh-server_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openssh-server is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openssh-server_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package openscap-scanner is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_opensc_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package opensc is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_opensc_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package openldap-clients is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_openldap-clients_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package ntpdate is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_ntpdate_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package nss-tools is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nss-tools_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nis_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nis is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nis_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package nfs-utils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_nfs-utils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package net-snmp is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_net-snmp_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package mcstrans is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_mcstrans_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libselinux is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libselinux_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libreswan is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libreswan_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package libcap-ng-utils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package krb5-workstation is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="Package kernel-PAE is installed">
                <lin-def:object object_ref="oval:ssg-obj_package_kernel-PAE_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package iptables is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_iptables_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package iprutils is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_iprutils_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package inetutils-telnetd is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package gssproxy is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gssproxy_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" check="only one" comment="Fedora 9867c58f release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1" version="1" check="only one" comment="Fedora 9570ff31 release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-9570ff31-5e3006fb:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" check="only one" comment="Fedora 45719a39 release key package is installed">
                <lin-def:object object_ref="oval:ssg-object_package_gpg-pubkey:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package gnutls-utils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package geolite2-country is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_geolite2-country_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package geolite2-city is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_geolite2-city_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gdm_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package gdm is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gdm_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package gdm is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package fapolicyd is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_fapolicyd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_esc_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package esc is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_esc_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package dnf-automatic is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package dconf is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_dconf_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cryptsetup-luks is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package cron is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_cron_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_binutils_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package binutils is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_binutils_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_bind_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package bind is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_bind_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_avahi_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package avahi is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_avahi_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audit-audispd-plugins is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package audispd-plugins is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_aide_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package aide is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_aide_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-sosreport is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-rhtsupport is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-plugin-logger is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-cli is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-cli_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-addon-python_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-addon-python is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-addon-kerneloops is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" check_existence="none_exist" check="all" comment="package abrt-addon-ccpp is removed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package MFEhiplsm is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package GConf2 is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_package_GConf2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" check_existence="none_exist" check="all" comment="/var/log/audit files uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit files uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" check_existence="none_exist" check="all" comment="/var/log/audit directories uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_directories:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" check_existence="all_exist" check="all" comment="/var/log/audit directories uid root gid root">
                <unix-def:object object_ref="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_lib_files:tst:1" version="1" check_existence="none_exist" check="all" comment="library files uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_lib_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="library directories uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_lib_dir:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_binary_files:tst:1" version="1" check_existence="none_exist" check="all" comment="binary files uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_binary_files:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_ownership_binary_directories:tst:1" version="1" check_existence="none_exist" check="all" comment="binary directories uid root">
                <unix-def:object object_ref="oval:ssg-object_file_ownership_binary_directories:obj:1"/>
              </unix-def:file_test>
              <lin-def:partition_test id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /opt optional yes">
                <lin-def:object object_ref="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" comment="openSUSE Leap 42 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" comment="openSUSE Leap 15 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" comment="openSUSE is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_openssh-server_version:tst:1" version="1" check="all" comment="OpenSSH is version 7.4 or higher">
                <lin-def:object object_ref="oval:ssg-obj_openssh-server_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_openssh-server_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nx_disabled_grub:tst:1" version="1" check_existence="none_exist" check="all" comment="NX is disabled">
                <ind-def:object object_ref="oval:ssg-object_nx_disabled_grub:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" comment="check /usr/lib/systemd/system/ntpd.service">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" comment="check /etc/sysconfig/ntpd">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure more than one ntpd NTP server is set">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_multiple_servers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" check_existence="all_exist" check="all" comment="ensure ipv6 restrictions">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" check_existence="all_exist" check="all" comment="ensure ipv4 restrictions">
                <ind-def:object object_ref="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if maxpoll is set in /etc/ntp.conf">
                <ind-def:object object_ref="oval:ssg-obj_ntp_set_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_remote_server:tst:1" version="1" check="all" comment="Ensure at least one ntpd NTP server is set">
                <ind-def:object object_ref="oval:ssg-obj_ntp_remote_server:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if all server entries have maxpoll set in /etc/ntp.conf">
                <ind-def:object object_ref="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'nosuid' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'nosuid' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD does not exist in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="NOPASSWD does not exist /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_nopasswd_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_sudoers:tst:1" version="1" check="all" comment="noexec exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_noexec_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'noexec' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'noexec' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" check_existence="none_exist" check="all" comment="NX is not disabled in the kernel command line">
                <ind-def:object object_ref="oval:ssg-obj_noexec_cmd_line:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on local filesystems">
                <lin-def:object object_ref="oval:ssg-object_non_root_partitions:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_local_nodev:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" comment="Check if removable partition is configured with 'nodev' mount option in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" comment="'nodev' mount option used for at least one CD / DVD drive alternative names in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_user_spec_rules:tst:1" version="1" check_existence="none_exist" check="all" comment="make sure that all user specs in sudoers feature a runas spec">
                <ind-def:object object_ref="oval:ssg-object_no_runas_spec:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" check_existence="none_exist" check="all" comment="check that tmux is not listed in /etc/shells">
                <ind-def:object object_ref="oval:ssg-obj_no_tmux_in_shells:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" check="all" comment="look for .rhosts in /root">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_root:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" check="all" comment="look for .rhosts in /home">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_home:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" check="all" comment="look for /etc/hosts.equiv">
                <unix-def:object object_ref="oval:ssg-object_no_rsh_trust_files_etc:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" check_existence="none_exist" check="all" comment="Make sure that no user spec in sudoers has a runas spec that includes root or ALL">
                <ind-def:object object_ref="oval:ssg-root_or_ALL_in_runas_spec:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_netrc_files_home:tst:1" version="1" check="all" comment="look for .netrc in /home">
                <unix-def:object object_ref="oval:ssg-object_no_netrc_files_home:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of lines starting with +">
                <ind-def:object object_ref="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" check_existence="none_exist" check="all" comment="Tests the value of the insecure locks in /etc/exports">
                <ind-def:object object_ref="oval:ssg-obj_no_insecure_locks_exports:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_empty_passwords:tst:1" version="1" check_existence="none_exist" check="all" comment="make sure nullok is not used in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_no_empty_passwords:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_direct_root_logins:tst:1" version="1" check_existence="all_exist" check="all" comment="no entries in /etc/securetty">
                <ind-def:object object_ref="oval:ssg-object_no_direct_root_logins:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" check="all" comment="look for runlevel1.target in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_runlevel1_target:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" check="all" comment="look for rescue.service in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_rescue_service:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" check="all" comment="look for emergency.target in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_emergency_target:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" check="all" comment="look for emergency.service in /etc/systemd/system">
                <unix-def:object object_ref="oval:ssg-object_no_custom_emergency_service:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" check_existence="none_exist" check="all" comment="'CD/DVD drive is not listed in /etc/fstab">
                <ind-def:object object_ref="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" comment="!authenticate does not exist in /etc/sudoers.d">
                <ind-def:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" comment="!authenticate does not exist in /etc/sudoers">
                <ind-def:object object_ref="oval:ssg-object_no_authenticate_etc_sudoers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" check_existence="all_exist" check="all" comment="polkit is properly configured to prevent non-privilged users from changing networking settings">
                <ind-def:object object_ref="oval:ssg-object_network_nmcli_permissions:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_network_nmcli_permissions:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" check_existence="all_exist" check="all" comment="Set static IPv6 address on each interface">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_static_address:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" check_existence="all_exist" check="all" comment="Enable privacy extensions on each interface">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" check_existence="none_exist" check="all" comment="Test for udp6 based rpc services">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" check_existence="none_exist" check="all" comment="Test for tcp6 based rpc services">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" check_existence="all_exist" check="all" comment="Define default gateways">
                <ind-def:object object_ref="oval:ssg-obj_network_ipv6_default_gateway:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_usbguard_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_usbguard_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_syslogng_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_syslogng_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_syslogng:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_syslogng_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_syslogng_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rsyslog_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rsyslog_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rngd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_rngd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_pcscd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_pcscd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntpd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntpd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntp_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ntp_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_iptables_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_iptables_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ip6tables_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_ip6tables_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_firewalld_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_firewalld_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_dnf-automatic_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_crond_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_crond_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_cron_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_cron_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_chronyd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_chronyd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_auditd_socket_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:systemdunitdependency_test id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" check_existence="any_exist" check="all" comment="systemd test">
                <lin-def:object object_ref="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_systemd_auditd_on:ste:1"/>
              </lin-def:systemdunitdependency_test>
              <lin-def:partition_test id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" check="all" comment="Ensure /var/tmp and /tmp have the same source device">
                <lin-def:object object_ref="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" check="all" comment="Ensure bind mount option is on /var/tmp">
                <ind-def:object object_ref="oval:ssg-object_mount_option_var_tmp_bind:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" check="all" comment="Ensure /var/tmp is mounted">
                <lin-def:object object_ref="oval:ssg-object_mount_option_var_tmp:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_messages_nx_active:tst:1" version="1" check_existence="none_exist" check="all" comment="No log messages about NX being disabled">
                <ind-def:object object_ref="oval:ssg-obj_messages_nx_active:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="Runtime Libraries package is installed">
                <lin-def:object object_ref="oval:ssg-obj_mcafee_runtime_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" check_existence="all_exist" check="all" comment="Agent package is installed">
                <lin-def:object object_ref="oval:ssg-obj_mcafee_management_agent:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="McAfee Policy Auditor installed">
                <unix-def:object object_ref="oval:ssg-object_mcafee_auditengine_exists:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="McAfee ACCM installed">
                <unix-def:object object_ref="oval:ssg-object_mcafee_accm_exists:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/lsb-release exists">
                <unix-def:object object_ref="oval:ssg-obj_lsb:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" check_existence="all_exist" check="all" comment="Test SplitHosts">
                <ind-def:object object_ref="oval:ssg-object_logwatch_configured_splithosts:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" check_existence="all_exist" check="all" comment="Test HostLimit">
                <ind-def:object object_ref="oval:ssg-object_logwatch_configured_hostlimit:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" check_existence="none_exist" check="all" comment="Test if there is no weekly/monthly/yearly keyword">
                <ind-def:object object_ref="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the presence of daily setting in /etc/logrotate.conf file">
                <ind-def:object object_ref="oval:ssg-object_logrotate_conf_daily_setting:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_logfile_sudoers:tst:1" version="1" check="all" comment="logfile exists in /etc/sudoers or /etc/sudoers.d/">
                <ind-def:object object_ref="oval:ssg-object_logfile_sudoers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_logfile_sudoers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" check_existence="all_exist" check="all" comment="AntiVirus package is installed">
                <lin-def:object object_ref="oval:ssg-obj_linuxshield_install_antivirus:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" check="all" comment="the value maxlogins should be set appropriately in /etc/security/limits.d/*.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_maxlogins:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" comment="kernel module vfat disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" comment="kernel module vfat disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_vfat_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" comment="kernel module usb-storage disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" comment="kernel module usb-storage disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" comment="kernel module udf disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" comment="kernel module udf disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" comment="kernel module udf disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_udf_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" comment="kernel module tipc disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" comment="kernel module tipc disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_tipc_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module squashfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" comment="kernel module squashfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_squashfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" comment="kernel module rds disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" comment="kernel module rds disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" comment="kernel module rds disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_rds_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" comment="kernel module jffs2 disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" comment="kernel module jffs2 disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_jffs2_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfsplus disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" comment="kernel module hfsplus disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module hfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" comment="kernel module hfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_hfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module freevxfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" comment="kernel module freevxfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" comment="kernel module firewire-core disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" comment="kernel module firewire-core disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" comment="kernel module dccp disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" comment="kernel module dccp disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_dccp_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" comment="kernel module cramfs disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" comment="kernel module cramfs disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_cramfs_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" comment="kernel module can disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" comment="kernel module can disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" comment="kernel module can disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_can_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" comment="kernel module bluetooth disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" comment="kernel module bluetooth disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /run/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modprobe.conf">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" comment="kernel module atm disabled in /usr/lib/modprobe.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" comment="kernel module atm disabled in /etc/modules-load.d">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" comment="kernel module atm disabled">
                <ind-def:object object_ref="oval:ssg-obj_kernmod_atm_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" comment="ipv6 disabled any modprobe conf file">
                <ind-def:object object_ref="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" check_existence="none_exist" check="all" comment="Ensure keytab file does not exist">
                <unix-def:object object_ref="oval:ssg-obj_kerberos_disable_no_keytab:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /run/.containerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /.dockerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" comment="SSSD Configuration is set to use Active Directory">
                <ind-def:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /home optional yes">
                <lin-def:object object_ref="oval:ssg-object_home_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_home_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of MACs setting in the /etc/crypto-policies/back-ends/openssh.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of CRYPTO_POLICY setting in the /etc/crypto-policies/back-ends/opensshserver.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_sshd_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" check="all" comment="test the value of Ciphers setting in the /etc/crypto-policies/back-ends/openssh.config file">
                <ind-def:object object_ref="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of RekeyLimit setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of PubkeyAcceptedKeyTypes setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of Match setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of MACs setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of KexAlgorithms setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of GSSAPIAuthentication setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the absence of Ciphers setting in the /etc/ssh/ssh_config.d/02-ospp.conf file">
                <ind-def:object object_ref="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters vsyscall=none in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_vsyscall_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_vsyscall_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/efi/EFI/redhat/user.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_uefi_password_usercfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/efi/EFI/redhat/grub.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_uefi_password_grubcfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/grub2/grub.cfg does not exist">
                <unix-def:object object_ref="oval:ssg-object_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/grub2/grub.cfg does not exist">
                <unix-def:object object_ref="oval:ssg-object_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters slub_debug=P in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_slub_debug_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_slub_debug_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters pti=on in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_pti_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_pti_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/grub2/user.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_password_usercfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" comment="make sure a password is defined in /boot/grub2/grub.cfg">
                <ind-def:object object_ref="oval:ssg-object_grub2_password_grubcfg:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/grub2/grub.cfg does not exist">
                <unix-def:object object_ref="oval:ssg-object_grub2_password_file_boot_grub2_grub_cfg_absent:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters page_poison=1 in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_page_poison_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_page_poison_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of GRUB_CMDLINE_LINUX setting in the /etc/default/grub file">
                <ind-def:object object_ref="oval:ssg-obj_grub2_nousb_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_nousb_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters ipv6.disable=1 in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_ipv6_disable_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_ipv6_disable_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters iommu=force in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_iommu_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_iommu_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" check_existence="none_exist" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT">
                <ind-def:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" check_existence="none_exist" check="all" comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX">
                <ind-def:object object_ref="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_default_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="check for GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub">
                <ind-def:object object_ref="oval:ssg-object_grub2_default_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters audit_backlog_limit=8192 in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_backlog_limit_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" comment="check forkernel command line parameters audit=1 in /boot/grub2/grubenv for all kernels">
                <ind-def:object object_ref="oval:ssg-object_grub2_audit_argument_grub_env:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_grub2_audit_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/grub2/grub.cfg does not exist">
                <unix-def:object object_ref="oval:ssg-object_grub2_admin_username_file_boot_grub2_grub_cfg_absent:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" check_existence="none_exist" check="all" comment="system commands are owned by root">
                <unix-def:object object_ref="oval:ssg-object_groupownership_system_commands_dirs:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/gdm/custom.conf exists for gnome_gdm_disable_xdmcp">
                <unix-def:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Enable setting in the /etc/gdm/custom.conf file">
                <ind-def:object object_ref="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable thumbnailers in GNOME3">
                <ind-def:object object_ref="oval:ssg-obj_gnome_disable_thumbnailers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" check_existence="all_exist" check="all" comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group">
                <ind-def:object object_ref="oval:ssg-object_gid_passwd_group_same:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gid_passwd_group_same:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="login banner text is correctly set">
                <ind-def:object object_ref="oval:ssg-obj_gdm_login_banner_text_setting:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_gdm_login_banner_text_setting:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_present_banner:tst:1" version="1" check_existence="all_exist" check="all" comment="Banner for FTP Users">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_present_banner:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_format:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" check_existence="all_exist" check="all" comment="log ftp transactions">
                <ind-def:object object_ref="oval:ssg-object_test_ftp_log_transactions_enable:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that force_card_driver is configured for opensc">
                <ind-def:object object_ref="oval:ssg-object_force_opensc_card_drivers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_force_opensc_card_drivers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_firewalld_input_drop:tst:1" version="1" check_existence="all_exist" check="all" comment="Check /etc/firewalld/firewalld.conf DefaultZone for drop">
                <ind-def:object object_ref="oval:ssg-obj_firewalld_input_drop:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpmverifyfile_test id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check_existence="none_exist" check="all" comment="verify file md5 hashes">
                <lin-def:object object_ref="oval:ssg-object_files_fail_md5_hash:obj:1"/>
              </lin-def:rpmverifyfile_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_messages:tst:1" version="2" check="all" comment="Testing mode of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_var_log_messages:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" check="all" comment="/var/log/audit files mode 0600">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_files:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0600:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0640">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_files-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_var_log:tst:1" version="2" check="all" comment="Testing mode of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_var_log:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" check_existence="none_exist" check="all" comment="files with no group owner">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_ungroupowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" check_existence="none_exist" check="all" comment="world writable files">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" check_existence="none_exist" check="all" comment="suid files outside system RPMs">
                <unix-def:object object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" check_existence="none_exist" check="all" comment="sgid files outside system RPMs">
                <unix-def:object object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" version="2" check="all" comment="Testing mode of /etc/ssh/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_sshd_pub_key:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_sshd_private_key:tst:1" version="2" check="all" comment="Testing mode of /etc/ssh/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_sshd_private_key:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" check="all" comment="home directories">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_home_dirs:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_home_dirs_wrong_perm:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_grub2_cfg:tst:1" version="2" check="all" comment="Testing mode of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_shadow:tst:1" version="2" check="all" comment="Testing mode of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_passwd:tst:1" version="2" check="all" comment="Testing mode of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_motd:tst:1" version="2" check="all" comment="Testing mode of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_motd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_issue:tst:1" version="2" check="all" comment="Testing mode of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_issue:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_gshadow:tst:1" version="2" check="all" comment="Testing mode of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_group:tst:1" version="2" check="all" comment="Testing mode of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" version="2" check="all" comment="Testing mode of /etc/audit/rules.d/">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_audit_rulesd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" version="2" check="all" comment="Testing mode of /etc/audit/auditd.conf">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_etc_audit_auditd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" version="2" check="all" comment="Testing mode of /boot/efi/EFI/fedora/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" version="2" check="all" comment="Testing mode of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" version="2" check="all" comment="Testing mode of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" version="2" check="all" comment="Testing mode of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_permissions_backup_etc_group:tst:1" version="2" check="all" comment="Testing mode of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_permissions_backup_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_var_log_messages:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_owner_var_log_messages:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_var_log_messages_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_var_log:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_owner_var_log:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_var_log_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_owner_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_grub2_cfg_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_shadow:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_shadow_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_passwd_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing user ownership of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_motd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_motd_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_issue:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_issue:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_issue_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_gshadow_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_etc_group:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_owner_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_etc_group_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing user ownership of /boot/efi/EFI/fedora/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_owner_efi_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_shadow:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing user ownership of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_backup_etc_shadow_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_passwd:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing user ownership of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_backup_etc_passwd_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing user ownership of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_owner_backup_etc_group:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing user ownership of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_owner_backup_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_owner_backup_etc_group_uid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_var_log_messages:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /var/log/messages">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_var_log_messages:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_var_log_messages_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_var_log:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /var/log/">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_var_log:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_var_log_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /boot/grub2/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_grub2_cfg_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_shadow:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /etc/shadow">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_shadow_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /etc/passwd">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_passwd_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing group ownership of /etc/motd">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_motd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_motd_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_issue:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /etc/issue">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_issue:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_issue_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /etc/gshadow">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_gshadow_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /etc/group">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_etc_group_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing group ownership of /boot/efi/EFI/fedora/grub.cfg">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_efi_grub2_cfg:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing group ownership of /etc/shadow-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_shadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing group ownership of /etc/passwd-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_passwd:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing group ownership of /etc/gshadow-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_gshadow:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_file_groupowner_backup_etc_group:tst:1" version="1" check_existence="any_exist" check="all" comment="Testing group ownership of /etc/group-">
                <unix-def:object object_ref="oval:ssg-object_file_groupowner_backup_etc_group:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_file_groupowner_backup_etc_group_gid_0:ste:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora">
                <ind-def:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" comment="fedora-release RPM packages are installed">
                <lin-def:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:variable_test id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" check="all" comment="Verify the existence of var_umask_for_daemons_as_number variable">
                <ind-def:object object_ref="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" check="all" comment="Verify the existence of var_accounts_user_umask_as_number variable">
                <ind-def:object object_ref="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1"/>
              </ind-def:variable_test>
              <unix-def:file_test id="oval:ssg-test_etc_system_fips:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/system-fips exists">
                <unix-def:object object_ref="oval:ssg-object_etc_system_fips:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_selinux_config:tst:1" version="1" check_existence="all_exist" check="all" comment="/selinux/enforce is 1">
                <ind-def:object object_ref="oval:ssg-object_etc_selinux_config:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_selinux_config:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_securetty_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/securetty file exists">
                <ind-def:object object_ref="oval:ssg-object_etc_securetty_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" check_existence="all_exist" check="all" comment="TMOUT in /etc/profile.d/*.sh">
                <ind-def:object object_ref="oval:ssg-object_etc_profiled_tmout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_profile_tmout:tst:1" version="2" check_existence="all_exist" check="all" comment="TMOUT in /etc/profile">
                <ind-def:object object_ref="oval:ssg-object_etc_profile_tmout:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_profile_tmout:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate user name entries in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" check_existence="all_exist" check="all" comment="There should not exist duplicate user ids in /etc/passwd">
                <ind-def:object object_ref="oval:ssg-obj_count_of_all_uids:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_no_duplicate_uids:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" check="all" comment="The value of ENCRYPT_METHOD should be set appropriately in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_last_encrypt_method_instance_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_last_encrypt_method_instance_value:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" check="all" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf">
                <ind-def:object object_ref="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" check="all" comment="the value INACTIVE parameter should be set appropriately in /etc/default/useradd">
                <ind-def:object object_ref="oval:ssg-object_etc_default_useradd_inactive:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_default_useradd_inactive:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_ends:tst:1" version="1" check="none satisfy" comment="environment variable PATH ends with : or .">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_ends_colon_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" check="none satisfy" comment="environment variable PATH contains relative paths">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_relative_path:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain . twice in a row">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_double_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" check="none satisfy" comment="environment variable PATH doesn't contain : twice in a row">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_contains_double_colon:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_begins_slash:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with an absolute path /">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_begins_slash:ste:1"/>
              </ind-def:environmentvariable58_test>
              <ind-def:environmentvariable58_test id="oval:ssg-test_env_var_begins:tst:1" version="1" check="none satisfy" comment="environment variable PATH starts with : or .">
                <ind-def:object object_ref="oval:ssg-object_root_path_no_dot:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_begins_colon_period:ste:1"/>
              </ind-def:environmentvariable58_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" comment="system has package zipl installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" comment="system has package yum installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" comment="system has package systemd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" comment="system has package sudo installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" comment="system has package sssd-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package postfix is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" comment="system has package pam installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" comment="system has package nss-pam-ldapd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" comment="system has package net-snmp installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
                <lin-def:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" comment="system has package libuser installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" comment="system has package grub2-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" comment="system has package gdm installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" comment="system has package audit installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" check_existence="none_exist" check="all" comment="check for existence of gpgcheck=0 in /etc/yum.repos.d/ files">
                <ind-def:object object_ref="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" check_existence="all_exist" check="all" comment="check value of gpgcheck in /etc/dnf/dnf.conf">
                <ind-def:object object_ref="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" check_existence="none_exist" check="all" comment="check that no audit rule exists in /etc/audit/rules.d/*.rules that disables all syscall auditing">
                <ind-def:object object_ref="oval:ssg-object_enable_syscall_audit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" check_existence="none_exist" check="all" comment="check that no audit rule exists in /etc/audit/audit.rules that disables all syscall auditing">
                <ind-def:object object_ref="oval:ssg-object_enable_syscall_audit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_pam_namespace:tst:1" version="1" check="all" comment="tests the presence of pam_namespace.so module in the /etc/pam.d/login file">
                <ind-def:object object_ref="oval:ssg-obj_enable_pam_namespace:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" check_existence="all_exist" check="all" comment="Enable GUI Login Smartcard authentication">
                <ind-def:object object_ref="oval:ssg-obj_enable_gnome_smartcard:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" check_existence="all_exist" check="all" comment="add_dracutmodules contains fips">
                <ind-def:object object_ref="oval:ssg-object_enable_dracut_fips_module:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_enable_dracut_fips_module:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" comment="Verify if /sys/firmware/efi folder exists">
                <unix-def:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_security_updates_only">
                <unix-def:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of upgrade_type setting in the /etc/dnf/automatic.conf file">
                <ind-def:object object_ref="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dnf-automatic_security_updates_only:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/dnf/automatic.conf exists for dnf-automatic_apply_updates">
                <unix-def:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of apply_updates setting in the /etc/dnf/automatic.conf file">
                <ind-def:object object_ref="oval:ssg-obj_dnf-automatic_apply_updates:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dnf-automatic_apply_updates:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" check_existence="none_exist" check="all" comment="Forbid 'silent' option for pam_lastlog">
                <ind-def:object object_ref="oval:ssg-obj_display_login_attempts_silent:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_display_login_attempts:tst:1" version="1" check="all" comment="Check the pam_lastlog configuration">
                <ind-def:object object_ref="oval:ssg-obj_display_login_attempts:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:symlink_test id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" check_existence="all_exist" check="all" comment="default.target systemd softlink exists">
                <unix-def:object object_ref="oval:ssg-object_disable_xwindows_runlevel_target:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_disable_xwindows_runlevel_target:ste:1"/>
              </unix-def:symlink_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable wifi notification">
                <ind-def:object object_ref="oval:ssg-obj_disable_wifi_notification:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable wifi creation">
                <ind-def:object object_ref="oval:ssg-obj_disable_wifi_creation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI user list is disabled">
                <ind-def:object object_ref="oval:ssg-obj_disable_user_list:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable system geolocation">
                <ind-def:object object_ref="oval:ssg-obj_disable_sys_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI restart and shutdown buttons are disabled">
                <ind-def:object object_ref="oval:ssg-obj_disable_restart_buttons:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of HostbasedAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of HostbasedAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth_config_dir_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth_config_dir:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_disable_host_auth_config_dir:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_host_auth:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file">
                <ind-def:object object_ref="oval:ssg-obj_disable_host_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_disable_host_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_guest_login:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable GDM Guest Login">
                <ind-def:object object_ref="oval:ssg-obj_disable_guest_login:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable power settings">
                <ind-def:object object_ref="oval:ssg-obj_disable_gnome_power_setting:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable Ctrl-Alt-Del">
                <ind-def:object object_ref="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:symlink_test id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:object object_ref="oval:ssg-object_disable_ctrlaltdel_exists:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_disable_ctrlaltdel_exists:ste:1"/>
              </unix-def:symlink_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable clock geolocation">
                <ind-def:object object_ref="oval:ssg-obj_disable_clock_geolocation:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_disable_automatic_login:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable GDM Automatic Login">
                <ind-def:object object_ref="oval:ssg-obj_disable_automatic_login:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" check="all" comment="check for local directories that are world writable and have uid greater than 0">
                <unix-def:object object_ref="oval:ssg-all_local_directories_uid_zero:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" check="all" comment="check for local directories that are world writable and have uid greater than or equal to 1000">
                <unix-def:object object_ref="oval:ssg-all_local_directories_uid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_uid_is_user_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" check="all" comment="check for local directories that are world writable and have gid greater than or equal to 1000">
                <unix-def:object object_ref="oval:ssg-all_local_directories_gid:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_gid_is_user_and_world_writable:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" check_existence="all_exist" check="all" comment="all local world-writable directories have sticky bit set">
                <unix-def:object object_ref="oval:ssg-object_only_local_directories:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_world_writable_and_not_sticky:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" check="all" comment="/var/log/audit mode 0700">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_directory:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0700:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" check="all" comment="/var/log/audit files mode 0750">
                <unix-def:object object_ref="oval:ssg-object_var_log_audit_directory-non_root:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_not_mode_0750:ste:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="library directories uid root">
                <unix-def:object object_ref="oval:ssg-object_dir_ownership_lib_dir:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_dir_group_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="library directories gid root">
                <unix-def:object object_ref="oval:ssg-object_dir_group_ownership_lib_dir:obj:1"/>
              </unix-def:file_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /dev/shm optional no">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" comment="/dev/shm exists">
                <lin-def:object object_ref="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" check_existence="all_exist" check="all" comment="check for DEFAULTKERNEL set to kernel-PAE in /etc/sysconfig/kernel">
                <ind-def:object object_ref="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_9:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_10:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/debian_version exists">
                <unix-def:object object_ref="oval:ssg-obj_debian:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_user_profile:tst:1" version="1" check_existence="all_exist" check="all" comment="dconf user profile exists">
                <ind-def:object object_ref="oval:ssg-obj_dconf_user_profile:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if the local dconf DB is up-to-date with keyfiles in the local tree.">
                <ind-def:object object_ref="oval:ssg-object_local_db_modified_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_local_db_is_up_to_date:ste:1"/>
              </ind-def:variable_test>
              <unix-def:file_test id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" comment="no keyfiles applicable to the local database">
                <unix-def:object object_ref="oval:ssg-obj_dconf_local_config:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of removal-action setting in the /etc/dconf/db/local.d/ file">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of user-administration-disabled setting in the /etc/dconf/db/local.d/ file">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable autorun in GNOME">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable automount-open in GNOME">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" check_existence="all_exist" check="all" comment="Disable automount in GNOME3">
                <ind-def:object object_ref="oval:ssg-obj_dconf_gnome_disable_automount:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /etc/crypto-policies/back-ends/nss.config exists">
                <unix-def:object object_ref="oval:ssg-object_crypto_policy_nss_config:obj:1"/>
              </unix-def:file_test>
              <ind-def:variable_test id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if update-crypto-policies has been run">
                <ind-def:object object_ref="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" comment="cron is configured in /etc/rsyslog.d">
                <ind-def:object object_ref="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" comment="cron is configured in /etc/rsyslog.conf">
                <ind-def:object object_ref="oval:ssg-obj_cron_logging_rsyslog:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" check_existence="all_exist" check="all" comment="Tests the existence of /etc/cron.daily/logrotate file (and verify it actually calls logrotate utility)">
                <ind-def:object object_ref="oval:ssg-object_cron_daily_logrotate_existence:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'BOOT_IMAGE' in /proc/cmdline">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-2-.*.conf">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if argument selinux=0 is present in the line starting with 'options ' in /boot/loader/entries/ostree-1-.*.conf">
                <ind-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if /boot/loader/entries/ostree-2-.*.conf does not exist">
                <unix-def:object object_ref="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coredump_disable_storage:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of Storage setting in the /etc/systemd/coredump.conf file">
                <ind-def:object object_ref="oval:ssg-obj_coredump_disable_storage:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coredump_disable_storage:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file">
                <ind-def:object object_ref="oval:ssg-obj_coredump_disable_backtraces:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_coredump_disable_backtraces:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limitsconf:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_core_dumps_limitsconf:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" check="all" comment="Tests for existance of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limits_d_exists:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" check="all" comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory">
                <ind-def:object object_ref="oval:ssg-object_core_dumps_limits_d:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_core_dumps_limits_d:ste:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/usbguard/usbguard-daemon.conf exists for configure_usbguard_auditbackend">
                <unix-def:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of AuditBackend setting in the /etc/usbguard/usbguard-daemon.conf file">
                <ind-def:object object_ref="oval:ssg-obj_configure_usbguard_auditbackend:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_usbguard_auditbackend:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" check_existence="all_exist" check="all" comment="check lock-command is set to vlock in /etc/tmux.conf">
                <ind-def:object object_ref="oval:ssg-obj_configure_tmux_lock_command:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" check_existence="all_exist" check="all" comment="check lock-after-time is set to 900 in /etc/tmux.conf">
                <ind-def:object object_ref="oval:ssg-obj_configure_tmux_lock_after_time:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" check_existence="none_exist" check="all" comment="Check that the SSH configuration mandates usage of system-wide crypto policies.">
                <ind-def:object object_ref="oval:ssg-object_configure_ssh_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" comment="configure remote access encryption">
                <ind-def:object object_ref="oval:ssg-obj_configure_remote_access_encryption:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" comment="configure remote access credentials">
                <ind-def:object object_ref="oval:ssg-obj_configure_remote_access_creds:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the configuration mandates usage of system-wide crypto policies.">
                <ind-def:object object_ref="oval:ssg-object_configure_openssl_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" check_existence="all_exist" check="all" comment="Check opensc library is configured in /etc/pki/nssdb/pkcs11.txt">
                <ind-def:object object_ref="oval:ssg-object_configure_opensc_nss_db:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that card_drivers is configured for opensc">
                <ind-def:object object_ref="oval:ssg-object_configure_opensc_card_drivers:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_opensc_card_drivers:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" check="all" comment="Ensure /var/tmp is configured to bind mount to /tmp">
                <ind-def:object object_ref="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the libreswan configuration includes the crypto policy config file">
                <ind-def:object object_ref="oval:ssg-object_configure_libreswan_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if kerberos configuration symlink and crypto policy kerberos backend symlink point to same file">
                <ind-def:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if kerberos configuration symlink links to the crypto-policy backend file">
                <ind-def:object object_ref="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" check="all" comment="tests the presence of '+VERS-ALL:-VERS-DTLS0.9:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-VERS-DTLS1.0' setting in the /etc/crypto-policies/back-ends/gnutls.config file">
                <ind-def:object object_ref="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/state/current">
                <ind-def:object object_ref="oval:ssg-object_configure_crypto_policy_current:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_crypto_policy_current:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_crypto_policy:tst:1" version="1" check_existence="only_one_exists" check="all" comment="check for crypto policy correctly configured in /etc/crypto-policies/config">
                <ind-def:object object_ref="oval:ssg-object_configure_crypto_policy:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_crypto_policy:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" comment="Check that the configuration includes the policy config file.">
                <ind-def:object object_ref="oval:ssg-object_configure_bind_crypto_policy:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" check_existence="only_one_exists" check="only one" comment="check tmux is configured to exec on the last line of /etc/bashrc">
                <ind-def:object object_ref="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_configure_bashrc_exec_tmux:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_configure_allowed_failures:tst:1" version="1" check_existence="all_exist" check="all" comment="Set number of login tries">
                <ind-def:object object_ref="oval:ssg-obj_configure_allowed_failures:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" comment="The configuration file /etc/sysconfig/chronyd exists for chronyd_run_as_chrony_user">
                <unix-def:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of OPTIONS setting in the /etc/sysconfig/chronyd file">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_run_as_chrony_user:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_remote_server:tst:1" version="1" check="all" comment="Ensure at least one NTP server is set">
                <ind-def:object object_ref="oval:ssg-object_chronyd_remote_server:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" check_existence="all_exist" check="all" comment="check if cmdport is 0 in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_cmdport_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_cmdport_value_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" comment="Ensure more than one chronyd NTP server is set">
                <ind-def:object object_ref="oval:ssg-object_chronyd_multiple_servers:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chronyd_client_only:tst:1" version="1" check_existence="all_exist" check="all" comment="check if port is 0 in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chronyd_port_value:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_chronyd_port_value_0:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if maxpoll is set in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chrony_set_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_time_service_set_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" comment="check if all server entries have maxpoll set in /etc/chrony.conf">
                <ind-def:object object_ref="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_server_has_maxpoll:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos7:tst:1" version="1" check="all" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_centos7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos6:tst:1" version="1" check="all" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_centos6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos6:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_unique_superuser:tst:1" version="1" check_existence="all_exist" check="all" comment="superuser is defined in /boot/grub2/grub.cfg files. Superuser is not root, admin, or administrator">
                <ind-def:object object_ref="oval:ssg-object_bootloader_unique_superuser:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1" version="1" check_existence="all_exist" check="all" comment="superuser is defined in /boot/grub2/grub.cfg. Superuser is not root, admin, or administrator">
                <ind-def:object object_ref="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_uefi_superuser:tst:1" version="2" check_existence="all_exist" check="all" comment="superuser is defined in /boot/grub2/grub.cfg.">
                <ind-def:object object_ref="oval:ssg-object_bootloader_uefi_superuser:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_superuser:tst:1" version="2" check_existence="all_exist" check="all" comment="superuser is defined in /boot/grub2/grub.cfg files.">
                <ind-def:object object_ref="oval:ssg-object_bootloader_superuser:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" check_existence="all_exist" check="all" comment="Check for GRUB_DISABLE_RECOVERY=true in /etc/default/grub">
                <ind-def:object object_ref="oval:ssg-object_bootloader_disable_recovery_argument:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_bootloader_disable_recovery_argument:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nosuid on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noexec on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="nodev on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <lin-def:partition_test id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" comment="noauto on /boot optional yes">
                <lin-def:object object_ref="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1"/>
              </lin-def:partition_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_gui_enabled:tst:1" version="1" check_existence="all_exist" check="all" comment="GUI banner is enabled">
                <ind-def:object object_ref="oval:ssg-obj_banner_gui_enabled:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_etc_motd:tst:1" version="1" check_existence="all_exist" check="all" comment="correct banner in /etc/motd">
                <ind-def:object object_ref="oval:ssg-object_banner_etc_motd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_banner_etc_motd:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_banner_etc_issue:tst:1" version="1" check="at least one" comment="correct banner in /etc/issue">
                <ind-def:object object_ref="oval:ssg-object_banner_etc_issue:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_banner_etc_issue:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of write_logs setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_write_logs:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of write_logs setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_write_logs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_write_logs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_overflow_action:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of overflow_action setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_overflow_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_overflow_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_name_format:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of name_format setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_name_format:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_name_format:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_log_format:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of log_format setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_log_format:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_log_format:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" comment="tests the absence of local_events setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_local_events:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of local_events setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_local_events:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_local_events:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_freq:tst:1" version="1" check_existence="all_exist" check="all" comment="tests the value of freq setting in the /etc/audit/auditd.conf file">
                <ind-def:object object_ref="oval:ssg-obj_auditd_freq:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_freq:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" check="all" comment="space left action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_space_left_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_space_left_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_num_logs:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_num_logs:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" check="all" comment="admin space left action ">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" check="all" comment="max log file size">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_max_log_file:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_max_log_file:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" check="all" comment="test the value of flush parameter in /etc/audit/auditd.conf">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_flush:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_flush:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" check="all" comment="space left action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" check="all" comment="email account for actions">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" check="all" comment="disk error action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_disk_full_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_disk_full_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" check="all" comment="disk full action">
                <ind-def:object object_ref="oval:ssg-object_auditd_data_disk_error_action:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_data_disk_error_action:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" check_existence="none_exist" check="all" comment="log_group = root">
                <ind-def:object object_ref="oval:ssg-object_auditd_conf_log_group_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" check_existence="all_exist" check="all" comment="log_group is set">
                <ind-def:object object_ref="oval:ssg-object_auditd_conf_log_group_is_set:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" check="all" comment="audispd syslog plugin activated">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" check="all" comment="setting in audisp-remote.conf">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" check="all" comment="remote server to send audit records">
                <ind-def:object object_ref="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" check="all" comment="audit shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" check="all" comment="audit passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" check="all" comment="audit opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" check="all" comment="audit gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" check="all" comment="audit augenrules group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" check="all" comment="audit group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/shadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/security/opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" check="all" comment="audit /etc/security/opasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" check="all" comment="audit /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" check="all" comment="audit /etc/gshadow">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" check="all" comment="audit augenrules /etc/group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" check="all" comment="audit /etc/group">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" check="all" comment="audit augenrules sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" check="all" comment="audit auditctl sudoers">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules usernetctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl usernetctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules userhelper">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl userhelper">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules unix_chkpwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl unix_chkpwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules umount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl umount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules sudoedit">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl sudoedit">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules sudo">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl sudo">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules su">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl su">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules ssh_keysign">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl ssh_keysign">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules pt_chown">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl pt_chown">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl passwd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newuidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newuidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newgrp">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newgrp">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules newgidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl newgidmap">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules mount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl mount">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules gpasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl gpasswd">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules crontab">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl crontab">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chsh">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chsh">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules at">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl at">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules seunshare">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl seunshare">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules setsebool">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl setsebool">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules semanage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl semanage">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules restorecon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl restorecon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit augenrules chcon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="audit auditctl chcon">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" check="all" comment="audit augenrules">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" check="all" comment="audit auditctl">
                <ind-def:object object_ref="oval:ssg-object_audit_rules_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="Test order of audit 32bit auditctl eperm rules order">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" comment="defined audit rule must exist">
                <ind-def:object object_ref="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" check="all" comment="audit /etc/localtime watch augenrules">
                <ind-def:object object_ref="oval:ssg-object_artw_etc_localtime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" check="all" comment="audit /etc/localtime watch auditctl">
                <ind-def:object object_ref="oval:ssg-object_artw_etc_localtime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules wtmp">
                <ind-def:object object_ref="oval:ssg-object_arse_wtmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl wtmp">
                <ind-def:object object_ref="oval:ssg-object_arse_wtmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules utmp">
                <ind-def:object object_ref="oval:ssg-object_arse_utmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl utmp">
                <ind-def:object object_ref="oval:ssg-object_arse_utmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" check="all" comment="audit augenrules btmp">
                <ind-def:object object_ref="oval:ssg-object_arse_btmp_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" check="all" comment="audit auditctl btmp">
                <ind-def:object object_ref="oval:ssg-object_arse_btmp_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="audit augenrules suid sgid">
                <ind-def:object object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="audit auditctl suid sgid">
                <ind-def:object object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_audit_rules_privileged_commands:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:variable_test id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="audit augenrules binaries count matches rules count">
                <ind-def:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1"/>
              </ind-def:variable_test>
              <ind-def:variable_test id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="audit auditctl binaries count matches rules count">
                <ind-def:object object_ref="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1"/>
              </ind-def:variable_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" check="all" comment="audit /etc/sysconfig/network auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue.net augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue.net auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" check="all" comment="audit /etc/issue augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" check="all" comment="audit /etc/issue auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_issue_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" check="all" comment="audit /etc/hosts augenrules">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" check="all" comment="audit /etc/hosts auditctl">
                <ind-def:object object_ref="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" check="all" comment="audit selinux changes augenrules">
                <ind-def:object object_ref="oval:ssg-object_armm_selinux_watch_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" check="all" comment="audit selinux changes auditctl">
                <ind-def:object object_ref="oval:ssg-object_armm_selinux_watch_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" check="all" comment="audit augenrules tallylog">
                <ind-def:object object_ref="oval:ssg-object_arle_tallylog_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" check="all" comment="audit auditctl tallylog">
                <ind-def:object object_ref="oval:ssg-object_arle_tallylog_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" check="all" comment="audit augenrules lastlog">
                <ind-def:object object_ref="oval:ssg-object_arle_lastlog_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" check="all" comment="audit auditctl lastlog">
                <ind-def:object object_ref="oval:ssg-object_arle_lastlog_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" check="all" comment="audit augenrules faillock">
                <ind-def:object object_ref="oval:ssg-object_arle_faillock_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" check="all" comment="audit auditctl faillock">
                <ind-def:object object_ref="oval:ssg-object_arle_faillock_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" check="all" comment="audit augenrules configuration locked">
                <ind-def:object object_ref="oval:ssg-object_ari_locked_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" check="all" comment="audit auditctl configuration locked">
                <ind-def:object object_ref="oval:ssg-object_ari_locked_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_rsyslogd:tst:1" version="1" check_existence="all_exist" check="all" comment="rsyslogd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_rsyslogd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_autrace:tst:1" version="1" check_existence="all_exist" check="all" comment="autrace is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_autrace:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" check_existence="all_exist" check="all" comment="ausearch is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_ausearch:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_aureport:tst:1" version="1" check_existence="all_exist" check="all" comment="aureport is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_aureport:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" check_existence="all_exist" check="all" comment="augenrules is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_augenrules:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_auditd:tst:1" version="1" check_existence="all_exist" check="all" comment="auditd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_auditd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" check_existence="all_exist" check="all" comment="auditctl is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_auditctl:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_verify_audispd:tst:1" version="1" check_existence="all_exist" check="all" comment="audispd is checked in /etc/aide.conf">
                <ind-def:object object_ref="oval:ssg-object_aide_verify_audispd:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_aide_check_attributes:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_aide_var_cron_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_test_aide_periodic_cron_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing existence of operational aide database file">
                <unix-def:object object_ref="oval:ssg-object_aide_operational_database_absolute_path:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" check_existence="all_exist" check="all" comment="run aide with cron.(daily|weekly)">
                <ind-def:object object_ref="oval:ssg-object_aide_crontabs_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_aide_crond_checking:tst:1" version="1" check_existence="all_exist" check="all" comment="run aide with cron">
                <ind-def:object object_ref="oval:ssg-object_test_aide_crond_checking:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" comment="Testing existence of new aide database file">
                <unix-def:object object_ref="oval:ssg-object_aide_build_new_database_absolute_path:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" check_existence="none_exist" check="all" comment="Check if there aren't directories in root's path having write permission set for group or other">
                <unix-def:object object_ref="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1" version="3" check_existence="all_exist" check="all" comment="Check if unlock time is never">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1" version="3" check_existence="all_exist" check="all" state_operator="OR" comment="Check if unlock time is never, or greater than or equal external variable">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_greater_or_equal_than_ext_var:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Check pam_faillock.so preauth silent present, with correct deny value, and is followed by pam_unix.">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Check pam_faillock.so preauth silent present in /etc/pam.d/password-auth, has correct deny value, and is followed by pam_unix">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check maximum preauth fail_interval allowed in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Checks if pam_faillock authfail is hit even if pam_unix skips lines by defaulting, and also authfail deny value">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check maximum preauth fail_interval allowed in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check maximum authfail fail_interval allowed in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1" version="1" check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/faillock.conf file">
                <ind-def:object object_ref="oval:ssg-obj_accounts_passwords_pam_faillock_enforce_local:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check maximum authfail fail_interval allowed in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Check control values of pam_unix, that it is followed by pam_faillock.so authfail and deny value of pam_faillock.so authfail">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="Check pam_faillock authfail is present after pam_unix, check pam_unix has proper control values, and authfail deny value is correct.">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1"/>
                <ind-def:state state_ref="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check if pam_faillock.so is required in account section in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_system-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1" version="2" check_existence="all_exist" check="all" comment="check if pam_faillock.so is required in account section in /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_password-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if pam_faillock.so is called in account phase before pam_unix">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if pam_faillock_so is called in account phase before pam_unix.">
                <ind-def:object object_ref="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if remember attribute of pam_unix.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_unix_remember:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/password-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" check_existence="all_exist" check="all" comment="Test if remember attribute of pam_pwhistory.so is set correctly in /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_password_pam_unix_remember:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" check="all" comment="check the configuration of /etc/pam.d/system-auth">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_faillock:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" check="all" comment="tests the presence of 'enforce_for_root' setting in the /etc/security/pwquality.conf file">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" check="all" comment="tests the presence of 'local_users_only' setting in the /etc/security/pwquality.conf file">
                <ind-def:object object_ref="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:shadow_test id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" check_existence="none_exist" check="all" comment="password hashes are shadowed using sha512">
                <unix-def:object object_ref="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1"/>
              </unix-def:shadow_test>
              <unix-def:password_test id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" check="all" comment="password hashes are shadowed">
                <unix-def:object object_ref="oval:ssg-object_accounts_password_all_shadowed:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_accounts_password_all_shadowed:ste:1"/>
              </unix-def:password_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" check_existence="none_exist" check="all" comment="test that there are no accounts with UID 0 except root in the /etc/passwd file">
                <ind-def:object object_ref="oval:ssg-object_accounts_no_uid_except_root:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" check_existence="all_exist" check="all" comment="check FAIL_DELAY in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-object_accounts_logon_fail_delay:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_logon_fail_delay:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" check_existence="all_exist" check="all" comment="Check value of CREATE_HOME in /etc/login.defs">
                <ind-def:object object_ref="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" comment="query /etc/passwd">
                <ind-def:object object_ref="oval:ssg-object_accounts_authorized_local_users:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_accounts_authorized_local_users:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" comment="CPUs support PAE kernel or NX bit">
                <ind-def:object object_ref="oval:ssg-obj_PAE_NX_cpu_support:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" comment="CPUs support for NX bit">
                <ind-def:object object_ref="oval:ssg-obj_NX_cpu_support:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit rename">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit rename">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit mount">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit mount">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chown">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 64-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 64-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eperm">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit file eacces">
                <ind-def:object object_ref="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit stime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_stime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit stime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_stime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit settimeofday">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit clock_settime">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit adjtimex">
                <ind-def:object object_ref="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlinkat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit unlink">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit umount2">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit sethostname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit setdomainname">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rmdir">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit renameat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit rename">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit rename">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit removexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit mount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit mount">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit lchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit init_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fsetxattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fremovexattr">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit finit_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchownat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmodat">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit fchmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit delete_module">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chown">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" check="all" comment="audit augenrules 32-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" check="all" comment="audit auditctl 32-bit chmod">
                <ind-def:object object_ref="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" check_existence="none_exist" check="all" comment="Check user ids on all files on the system">
                <unix-def:object object_ref="oval:ssg-file_permissions_unowned_object:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-dir_test_perms_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" comment="library directories go-w">
                <unix-def:object object_ref="oval:ssg-dir_object_file_permissions_lib_dir:obj:1"/>
              </unix-def:file_test>
            </tests>
            <objects>
              <unix-def:file_object id="oval:ssg-root_permissions_for_system_wide_library_files:obj:1" version="1" comment="system-wide directories">
                <unix-def:path operation="pattern match">^\/lib(|64)?$|^\/usr\/lib(|64)?$</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-group_permissions_for_system_wide_files_are_not_root:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-root_or_ALL_in_runas_spec:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*\([\w\s]*\b(root|ALL)\b[\w\s]*\)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_yum_ensure_gpgcheck_local_packages:obj:1" version="1" comment="localpkg_gpgcheck set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*localpkg_gpgcheck\s*=\s*(1|True|yes)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_wireless_disable_interfaces:obj:1" version="1">
                <ind-def:filepath>/proc/net/wireless</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*[-\w]+:</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_virtual_consoles_etc_securetty:obj:1" version="1" comment="virtual consoles /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^vc/[0-9]+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_vdsm_nopasswd_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!(#|vdsm.*)).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_var_umask_for_daemons_umask_as_number:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_umask_for_daemons_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfp_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfp_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfp_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfp_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfp_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfo_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfo_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfo_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfo_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfo_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_syslog_config:obj:1" version="1" comment="Make variable object for use">
                <ind-def:var_ref>oval:ssg-var_rfg_syslog_config:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_include_config_regex:obj:1" version="1" comment="Make variable object from regex variable">
                <ind-def:var_ref>oval:ssg-var_rfg_include_config_regex:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_rfg_all_log_files:obj:1" version="1" comment="Filter out empty string">
                <set>
                  <object_reference>oval:ssg-object_var_rfg_include_config_regex:obj:1</object_reference>
                  <object_reference>oval:ssg-object_var_rfg_syslog_config:obj:1</object_reference>
                </set>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_removable_partition_is_cd_dvd_drive:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_removable_partition:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_files:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0600:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_files-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_directory:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0700:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_var_log_audit_directory-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_not_mode_0750:ste:1</filter>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_var_faillock_unlock_time:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_var_accounts_user_umask_umask_as_number:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_accounts_user_umask_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_use_pty_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\buse_pty.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_use_pam_wheel_for_su:obj:1" version="1" comment="check /etc/pam.d/su for correct setting">
                <ind-def:filepath>/etc/pam.d/su</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_tmp_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_targetpw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !targetpw$\r?\n</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_runaspw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !runaspw$\r?\n</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_sudoers_rootpw_config:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Defaults !rootpw$\r?\n</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_present_banner:obj:1" version="1" comment="Banner for FTP Users">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*banner_file=/etc/issue[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_protocol:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*log_ftp_protocol[\s]*=[\s]*YES$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_format:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*xferlog_std_format[\s]*=[\s]*NO$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_ftp_log_transactions_enable:obj:1" version="1" comment="log ftp transactions">
                <ind-def:filepath>/etc/vsftpd/vsftpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*xferlog_enable[\s]*=[\s]*YES$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_aide_periodic_cron_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:filepath>/etc/crontab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_test_aide_crond_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:path>/etc/cron.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
                <unix-def:filepath>/sys/firmware/opal</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_system_privileged_commands:obj:1" version="1" comment="system files with setuid or setgid permission set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" max_depth="-1"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">[a-z]+</unix-def:filename>
                <filter action="include">oval:ssg-state_setuid_or_setgid_set:ste:1</filter>
                <filter>oval:ssg-state_dev_proc_sys_dirs:ste:1</filter>
              </unix-def:file_object>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_x86_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_x86:obj:1" version="1" comment="32 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_s390_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppc_64:obj:1" version="1" comment="64 bit architecture"/>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_aarch_64:obj:1" version="1" comment="64 bit architecture"/>
              <ind-def:textfilecontent54_object id="oval:ssg-object_system_auth_pam_unix_rounds:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/system-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_system_auth_default_pam_unix_rounds_var:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_vm_mmap_min_addr:obj:1" version="1">
                <unix-def:name>vm.mmap_min_addr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_user_max_user_namespaces:obj:1" version="1">
                <unix-def:name>user.max_user_namespaces</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.router_solicitations</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.max_addresses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.disable_ipv6</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.autoconf</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_rtr_pref</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_pinfo</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra_defrtr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.default.accept_ra</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.router_solicitations</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.max_addresses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.disable_ipv6</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.autoconf</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_rtr_pref</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_pinfo</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <unix-def:name>net.ipv6.conf.all.accept_ra_defrtr</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_tcp_syncookies:obj:1" version="1">
                <unix-def:name>net.ipv4.tcp_syncookies</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_local_port_range:obj:1" version="1">
                <unix-def:name>net.ipv4.ip_local_port_range</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_ip_forward:obj:1" version="1">
                <unix-def:name>net.ipv4.ip_forward</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <unix-def:name>net.ipv4.icmp_ignore_bogus_error_responses</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <unix-def:name>net.ipv4.icmp_echo_ignore_broadcasts</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.send_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.secure_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.rp_filter</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.log_martians</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.accept_source_route</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.default.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.send_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.secure_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.rp_filter</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.log_martians</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.accept_source_route</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <unix-def:name>net.ipv4.conf.all.accept_redirects</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_net_core_bpf_jit_harden:obj:1" version="1">
                <unix-def:name>net.core.bpf_jit_harden</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_yama_ptrace_scope:obj:1" version="1">
                <unix-def:name>kernel.yama.ptrace_scope</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <unix-def:name>kernel.unprivileged_bpf_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_sysrq:obj:1" version="1">
                <unix-def:name>kernel.sysrq</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_randomize_va_space:obj:1" version="1">
                <unix-def:name>kernel.randomize_va_space</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_pid_max:obj:1" version="1">
                <unix-def:name>kernel.pid_max</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_paranoid:obj:1" version="1">
                <unix-def:name>kernel.perf_event_paranoid</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <unix-def:name>kernel.perf_event_max_sample_rate</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <unix-def:name>kernel.perf_cpu_time_max_percent</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_modules_disabled:obj:1" version="1">
                <unix-def:name>kernel.modules_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kptr_restrict:obj:1" version="1">
                <unix-def:name>kernel.kptr_restrict</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_kexec_load_disabled:obj:1" version="1">
                <unix-def:name>kernel.kexec_load_disabled</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_dmesg_restrict:obj:1" version="1">
                <unix-def:name>kernel.dmesg_restrict</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_kernel_core_pattern:obj:1" version="1">
                <unix-def:name>kernel.core_pattern</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_suid_dumpable:obj:1" version="1">
                <unix-def:name>fs.suid_dumpable</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_symlinks:obj:1" version="1">
                <unix-def:name>fs.protected_symlinks</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_runtime_fs_protected_hardlinks:obj:1" version="1">
                <unix-def:name>fs.protected_hardlinks</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_kernel_exec_shield:obj:1" version="1">
                <unix-def:name>kernel.exec-shield</unix-def:name>
              </unix-def:sysctl_object>
              <unix-def:sysctl_object id="oval:ssg-object_sysctl_crypto_fips_enabled:obj:1" version="1">
                <unix-def:name>crypto.fips_enabled</unix-def:name>
              </unix-def:sysctl_object>
              <ind-def:variable_object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_no_command_negation:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sudoers_explicit_command_args:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+(?:[ \t]+[^,\s]+)+[ \t]*,)*(\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,\s]+[ \t]*(?:,|$))</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_usr_lib_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/usr/lib/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_user_max_user_namespaces:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_sysrq:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_pid_max:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_modules_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_exec_shield:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.exec-shield[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_kernel_core_pattern:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_suid_dumpable:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_symlinks:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_sysctl_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:filepath>/etc/sysctl.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_run_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/run/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_vm_mmap_min_addr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*vm.mmap_min_addr[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_user_max_user_namespaces:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*user.max_user_namespaces[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_max_addresses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.default.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_autoconf:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_default_accept_ra:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.router_solicitations[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_max_addresses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.max_addresses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_autoconf:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.autoconf[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_rtr_pref[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_pinfo[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv6.conf.all.accept_ra_defrtr[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_tcp_syncookies:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.tcp_syncookies[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_local_port_range:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_local_port_range[\s]*=[\s]*32768\s*65535[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_ip_forward:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.ip_forward[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_send_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_rp_filter:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_log_martians:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_send_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_rp_filter:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_log_martians:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">(?:^|.*\n)[^#]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(\d+)[\s]*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_net_core_bpf_jit_harden:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*net.core.bpf_jit_harden[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_yama_ptrace_scope:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.yama.ptrace_scope[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_unprivileged_bpf_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.unprivileged_bpf_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_sysrq:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.sysrq[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_randomize_va_space:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.randomize_va_space[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_pid_max:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.pid_max[\s]*=[\s]*65536[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_paranoid:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_paranoid[\s]*=[\s]*2[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_event_max_sample_rate:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_event_max_sample_rate[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_perf_cpu_time_max_percent:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.perf_cpu_time_max_percent[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_modules_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.modules_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kptr_restrict:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kptr_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_kexec_load_disabled:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.kexec_load_disabled[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_dmesg_restrict:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.dmesg_restrict[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_kernel_core_pattern:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*kernel.core_pattern[\s]*=[\s]*|/bin/false[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_suid_dumpable:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.suid_dumpable[\s]*=[\s]*0[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_symlinks:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_symlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_static_etc_sysctld_fs_protected_hardlinks:obj:1" version="1">
                <ind-def:path>/etc/sysctl.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*fs.protected_hardlinks[\s]*=[\s]*1[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_sssd_conf_exists:obj:1" version="1" comment="/etc/sssd/sssd.conf">
                <unix-def:filepath>/etc/sssd/sssd.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_requirement_unknown:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_required:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_sshd_not_required:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-sshd_required:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_max_sessions:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_max_auth_tries:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_idle_timeout:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveInterval[\s]+(\d+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_sshd_allow_only_protocol2:obj:1" version="3">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)Protocol[\s]+2[\s]*(?:|(?:#.*))?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_srv_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/srv</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_snmp_versions:obj:1" version="1">
                <ind-def:filepath>/etc/snmp/snmpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(com2se|rocommunity|rwcommunity)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_snmp_default_communities:obj:1" version="1">
                <ind-def:filepath>/etc/snmp/snmpd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^((?!#).)*(public|private).*</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_required_system_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_required_system_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_required_smartcard_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/smartcard-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_smart_card_enabled_system_auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_smart_card_enabled_system_auth:var:1" var_check="at least one"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_serial_ports_etc_securetty:obj:1" version="1" comment="serial ports /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ttyS[0-9]+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_grub_dir:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub.d, fail if found">
                <ind-def:path>/etc/grub.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_grub2_cfg:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found">
                <ind-def:filepath>/etc/grub2.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_enforcing:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*SELINUX[\s]*=[\s]*enforcing[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_unlabeled_t:obj:1" version="1" comment="unlabeled_t in /dev">
                <lin-def:filepath var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
                <filter action="include">oval:ssg-state_selinux_dev_unlabeled_t:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_dev_device_t:obj:1" version="1" comment="device_t in /dev">
                <lin-def:filepath var_ref="oval:ssg-variable_dev_device_files:var:1" var_check="at least one"/>
                <filter action="include">oval:ssg-state_selinux_dev_device_t:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_selinux_default_grub:obj:1" version="1" comment="check value selinux|enforcing=0 in /etc/default/grub, fail if found">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:selinuxsecuritycontext_object id="oval:ssg-object_selinux_confinement_of_daemons:obj:1" version="1" comment="find unconfined_service_t in /proc">
                <lin-def:behaviors max_depth="1" recurse_direction="down"/>
                <lin-def:path>/proc</lin-def:path>
                <lin-def:filename operation="pattern match">^.*$</lin-def:filename>
                <filter action="include">oval:ssg-state_selinux_confinement_of_daemons:ste:1</filter>
              </lin-def:selinuxsecuritycontext_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rsyslog_nolisten:obj:1" version="2">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp))</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_permissions:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfp_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_ownership:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfo_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_rsyslog_files_groupownership:obj:1" version="1" comment="Various system log files">
                <unix-def:filepath var_ref="oval:ssg-var_rfg_log_files_paths:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:environmentvariable58_object id="oval:ssg-object_root_path_no_dot:obj:1" version="1">
                <ind-def:pid xsi:nil="true" datatype="int"/>
                <ind-def:name>PATH</ind-def:name>
              </ind-def:environmentvariable58_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfp_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfp_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_permissions_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfo_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfo_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_owner_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" version="1" comment="rsyslog's $IncludeConfig directive and include() object values">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:include\([\n\s]*file="([^\s;]+)".*|\$IncludeConfig[\s]+([^\s;]+))$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_rfg_log_files_paths:obj:1" version="1" comment="All rsyslog configuration files">
                <ind-def:filepath operation="pattern match" var_ref="oval:ssg-var_rfg_all_log_files:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_groupownership_ignore_include_paths:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_requiretty_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\brequiretty.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_removable_partition_doesnt_exist:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_removable_partition:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_d:obj:1" version="1">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_remote_loghost_rsyslog_conf:obj:1" version="1">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\*\.\*[\s]+(?:@|\:omrelp\:)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:interface_object id="oval:ssg-object_promisc_interfaces:obj:1" version="1">
                <unix-def:name operation="pattern match">^.*$</unix-def:name>
                <filter action="include">oval:ssg-state_promisc:ste:1</filter>
              </unix-def:interface_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_64_bit:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_cpuinfo_64_bit:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags\s+:\s+(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_password_auth_pam_unix_rounds:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/pam.d/password-auth$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*rounds=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_password_auth_default_pam_unix_rounds_var:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_password_pam_unix_rounds:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_unix_sha512:obj:1" version="1" comment="check /etc/pam.d/system-auth for correct settings">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password[\s]+(?:(?:required)|(?:sufficient))[\s]+pam_unix\.so[\s]+.*sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_pkcs11_cert_policy_ocsp_on:obj:1" version="1">
                <ind-def:filepath>/etc/pam_pkcs11/pam_pkcs11.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*cert_policy[ ]=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+silent[\s]+[^\n]*even_deny_root[\s]*(?s).*[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_system-auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_pam_faillock_authfail_deny_root_password-auth:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[.*default=die.*\]))[\s]+pam_unix\.so[^\n]*(?s).*[\n][\s]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*even_deny_root[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1">
                <lin-def:name>gpg-pubkey</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_files:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_files-non_root:obj:1" version="1" comment="/var/log/audit files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_directories:obj:1" version="1" comment="/var/log/audit directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_not_root_root_var_log_audit:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_ownership_var_log_audit_directories-non_root:obj:1" version="1" comment="/var/log/audit directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all"/>
                <unix-def:path>/var/log/audit</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1</filter>
              </unix-def:file_object>
              <lin-def:partition_object id="oval:ssg-object_opt_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/opt</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_only_local_directories:obj:1" version="1" comment="only local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_world_writable_and_not_sticky:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nx_disabled_grub:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\s]*noexec[\s]*=[\s]*off</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nosuid_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nopasswd_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+NOPASSWD[\s]*\:.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_non_root_partitions:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/\w.*$</lin-def:mount_point>
                <filter action="include">oval:ssg-state_local_nodev:ste:1</filter>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\bnoexec.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_noexec_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_not_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_nodev_etc_fstab_cd_dvd_drive:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_runas_spec:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*((?!root\b)[\w]+)\s*(\w+)\s*=\s*(.*,)?\s*[^\(\s]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_root:obj:1" version="1" comment="look for .rhosts in /root">
                <unix-def:path>/root</unix-def:path>
                <unix-def:filename operation="pattern match">^\.rhosts$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_home:obj:1" version="1" comment="look for .rhosts in /home">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
                <unix-def:path>/home</unix-def:path>
                <unix-def:filename operation="pattern match">^\.rhosts$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_rsh_trust_files_etc:obj:1" version="1" comment="look for /etc/hosts.equiv">
                <unix-def:path>/etc</unix-def:path>
                <unix-def:filename operation="pattern match">^hosts\.equiv$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_netrc_files_home:obj:1" version="1" comment="look for .netrc in /home">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
                <unix-def:path>/home</unix-def:path>
                <unix-def:filename operation="pattern match">^\.netrc$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_shadow:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/shadow</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_passwd:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_legacy_plus_entries_etc_group:obj:1" version="1" comment="lines starting with +">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_empty_passwords:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^#]*\bnullok\b.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_direct_root_logins:obj:1" version="1" comment="no entries /etc/securetty">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_runlevel1_target:obj:1" version="1" comment="look for runlevel1.target in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^runlevel1.target$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_rescue_service:obj:1" version="1" comment="look for rescue.service in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^rescue.service$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_emergency_target:obj:1" version="1" comment="look for emergency.target in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^emergency.target$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_no_custom_emergency_service:obj:1" version="1" comment="look for emergency.service in /etc/systemd/system">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="all"/>
                <unix-def:path>/etc/systemd/system</unix-def:path>
                <unix-def:filename operation="pattern match">^emergency.service$</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_cd_dvd_drive_in_etc_fstab:obj:1" version="1">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" var_check="at least one"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers_d:obj:1" version="1">
                <ind-def:path>/etc/sudoers.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_no_authenticate_etc_sudoers:obj:1" version="1">
                <ind-def:filepath>/etc/sudoers</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#).*[\s]+\!authenticate.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_network_nmcli_permissions:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/polkit-1/localauthority/20-org.d/.*$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[.*\]\n\s*Identity=default\n\s*Action=org\.freedesktop\.NetworkManager\.\*\n\s*ResultAny=no\n\s*ResultInactive=no\n\s*(ResultActive=auth_admin)\n*\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_usbguard_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslogng_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_syslogng_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rsyslog_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_rngd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_pcscd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntpd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ntp_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_iptables_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_ip6tables_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_firewalld_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_dnf-automatic_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_crond_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_cron_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_chronyd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_socket_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:systemdunitdependency_object id="oval:ssg-object_multi_user_target_for_auditd_enabled:obj:1" version="1" comment="list of dependencies of multi-user.target">
                <lin-def:unit>multi-user.target</lin-def:unit>
              </lin-def:systemdunitdependency_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_log_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var/log</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountvar_log_audit_own_partition:obj:1" version="1">
                <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountusr_own_partition:obj:1" version="1">
                <lin-def:mount_point>/usr</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mounttmp_own_partition:obj:1" version="1">
                <lin-def:mount_point>/tmp</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountsrv_own_partition:obj:1" version="1">
                <lin-def:mount_point>/srv</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountopt_own_partition:obj:1" version="1">
                <lin-def:mount_point>/opt</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mounthome_own_partition:obj:1" version="1">
                <lin-def:mount_point>/home</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mountboot_own_partition:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_mount_option_var_tmp_bind_compare_source:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/tmp$</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_mount_option_var_tmp_bind:obj:1" version="1" comment="look for the partition mount point in /etc/mtab">
                <ind-def:filepath>/etc/mtab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_mount_option_var_tmp:obj:1" version="1">
                <lin-def:mount_point operation="pattern match">^/var/tmp$</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_mcafee_auditengine_exists:obj:1" version="1">
                <unix-def:path>/opt/McAfee/auditengine/bin</unix-def:path>
                <unix-def:filename>auditmanager</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_mcafee_accm_exists:obj:1" version="1">
                <unix-def:path>/opt/McAfee/accm/bin</unix-def:path>
                <unix-def:filename>accm</unix-def:filename>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logwatch_configured_splithosts:obj:1" version="1">
                <ind-def:filepath>/etc/logwatch/conf/logwatch.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]SplitHosts[\s]*=[\s]*yes[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logwatch_configured_hostlimit:obj:1" version="1">
                <ind-def:filepath>/etc/logwatch/conf/logwatch.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]HostLimit[\s]*=[\s]*no[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logrotate_conf_no_other_keyword:obj:1" version="2">
                <ind-def:filepath>/etc/logrotate.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*(weekly|monthly|yearly)[\s#]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logrotate_conf_daily_setting:obj:1" version="2">
                <ind-def:filepath>/etc/logrotate.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*daily[\s#]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_logfile_sudoers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sudoers(|\.d/.*)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Defaults.*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_local_db_modified_time:obj:1" version="1" comment="All modified times of all keyfiles">
                <ind-def:var_ref>oval:ssg-var_dconf_local_db_modified_time:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n(?!#|SYS_)(UID_MIN[\s]+[\d]+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MIN[\s]+[\d]+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(SYS_UID_MAX[\s]+[\d]+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_warn_age_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_warn_age_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_WARN_AGE\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_min_len_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_min_len_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_min_days_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_min_days_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_DAYS\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_kernel_module_ipv6_option_disabled:obj:1" version="1" comment="ipv6 disabled any modprobe conf file">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*options\s+ipv6\s+.*disable=1.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1" comment="kerberos crypto-policy configuration softlink">
                <unix-def:filepath>/etc/krb5.conf.d/crypto-policies</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1" comment="kerberos crypto-policy backend softlink">
                <unix-def:filepath>/etc/crypto-policies/back-ends/krb5.config</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" comment="Check file /run/.containerenv">
                <unix-def:filepath>/run/.containerenv</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" comment="Check file /.dockerenv">
                <unix-def:filepath>/.dockerenv</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_home_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/home</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_vsyscall_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_usercfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/user.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_uefi_password_grubcfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_slub_debug_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_pti_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_password_usercfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/user.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_password_grubcfg:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_grub2_password_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_page_poison_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_ipv6_disable_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_iommu_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux_default:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_disable_interactive_boot_grub_cmdline_linux:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX=".*systemd.confirm_spawn=(?:1|yes|true|on).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_default_exists:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_backlog_limit_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_grub2_audit_argument_grub_env:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grubenv</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^kernelopts=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_grub2_admin_username_file_boot_grub2_grub_cfg_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_groupownership_system_commands_dirs:obj:1" version="1" comment="system commands files">
                <unix-def:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*:x:([0-9]+):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*:[0-9]+:([0-9]+):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_force_opensc_card_drivers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/opensc.*.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]+force_card_driver[\s]+=[\s]+(\S+);$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-object_files_fail_mode:obj:1" version="1" comment="rpm verify of all files">
                <lin-def:behaviors nomd5="true" noghostfiles="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath operation="pattern match">.*</lin-def:filepath>
                <filter action="include">oval:ssg-state_files_fail_mode:ste:1</filter>
              </lin-def:rpmverifyfile_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" comment="rpm verify of all files">
                <lin-def:behaviors nomd5="false"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath operation="pattern match">^/(bin|sbin|lib|lib64|usr)/.+$</lin-def:filepath>
                <filter action="include">oval:ssg-state_files_fail_md5_hash:ste:1</filter>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" comment="/sys/firmware/efi">
                <unix-def:path>/sys/firmware/efi</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_var_log_messages:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_var_log:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_ungroupowned:obj:1" version="1" comment="all local files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">.*</unix-def:filename>
                <filter>oval:ssg-state_file_permissions_ungroupowned:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_unauthorized_world_write:obj:1" version="1" comment="world writable">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_world_write:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_systemmap_files:obj:1" version="1" comment="system.mapfiles">
                <unix-def:path>/boot</unix-def:path>
                <unix-def:filename operation="pattern match">^System\.map.*$</unix-def:filename>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_sshd_pub_key:obj:1" version="1" comment="/etc/ssh/">
                <unix-def:path>/etc/ssh/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*.pub$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_sshd_private_key:obj:1" version="1" comment="/etc/ssh/">
                <unix-def:path>/etc/ssh/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*_key$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_lib_files:obj:1" version="1" comment="library files">
                <unix-def:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
                <filter>oval:ssg-perms_state_symlink:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_lib_dir:obj:1" version="1" comment="library directories">
                <unix-def:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1</filter>
                <filter>oval:ssg-perms_state_symlink:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_home_dirs:obj:1" version="2" comment="home directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all"/>
                <unix-def:path>/home</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter>oval:ssg-state_home_dirs_home_itself:ste:1</filter>
                <filter action="include">oval:ssg-state_home_dirs_wrong_perm:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_grub2_cfg:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_shadow:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_passwd:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_motd:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_issue:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_gshadow:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_group:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_audit_rulesd:obj:1" version="1" comment="/etc/audit/rules.d/">
                <unix-def:path>/etc/audit/rules.d/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*rules$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_etc_audit_auditd:obj:1" version="1" comment="/etc/audit/auditd.conf">
                <unix-def:filepath>/etc/audit/auditd.conf</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_efi_grub2_cfg:obj:1" version="1" comment="/boot/efi/EFI/fedora/grub.cfg">
                <unix-def:filepath>/boot/efi/EFI/fedora/grub.cfg</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_binary_files:obj:1" version="1" comment="binary files">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1</filter>
                <filter>oval:ssg-state_perms_binary_files_symlink:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_shadow:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_passwd:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_gshadow:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_permissions_backup_etc_group:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
                <filter action="include">oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_lib_files:obj:1" version="1" comment="library files">
                <unix-def:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_lib_dir:obj:1" version="1" comment="library directories">
                <unix-def:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_libraries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_binary_files:obj:1" version="1" comment="binary files">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_ownership_binary_directories:obj:1" version="1" comment="binary directories">
                <unix-def:path operation="pattern match">^\/(|s)bin|^\/usr\/(|local\/)(|s)bin|^\/usr\/libexec</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_binaries_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_var_log_messages:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_var_log:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_grub2_cfg:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_shadow:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_passwd:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_motd:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_issue:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_gshadow:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_etc_group:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_efi_grub2_cfg:obj:1" version="1" comment="/boot/efi/EFI/fedora/grub.cfg">
                <unix-def:filepath>/boot/efi/EFI/fedora/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_shadow:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_passwd:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_gshadow:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_owner_backup_etc_group:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_var_log_messages:obj:1" version="1" comment="/var/log/messages">
                <unix-def:filepath>/var/log/messages</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_var_log:obj:1" version="1" comment="/var/log/">
                <unix-def:path>/var/log/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_grub2_cfg:obj:1" version="1" comment="/boot/grub2/grub.cfg">
                <unix-def:filepath>/boot/grub2/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_shadow:obj:1" version="1" comment="/etc/shadow">
                <unix-def:filepath>/etc/shadow</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_passwd:obj:1" version="1" comment="/etc/passwd">
                <unix-def:filepath>/etc/passwd</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_motd:obj:1" version="1" comment="/etc/motd">
                <unix-def:filepath>/etc/motd</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_issue:obj:1" version="1" comment="/etc/issue">
                <unix-def:filepath>/etc/issue</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_gshadow:obj:1" version="1" comment="/etc/gshadow">
                <unix-def:filepath>/etc/gshadow</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_etc_group:obj:1" version="1" comment="/etc/group">
                <unix-def:filepath>/etc/group</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_efi_grub2_cfg:obj:1" version="1" comment="/boot/efi/EFI/fedora/grub.cfg">
                <unix-def:filepath>/boot/efi/EFI/fedora/grub.cfg</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_shadow:obj:1" version="1" comment="/etc/shadow-">
                <unix-def:filepath>/etc/shadow-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_passwd:obj:1" version="1" comment="/etc/passwd-">
                <unix-def:filepath>/etc/passwd-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_gshadow:obj:1" version="1" comment="/etc/gshadow-">
                <unix-def:filepath>/etc/gshadow-</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_file_groupowner_backup_etc_group:obj:1" version="1" comment="/etc/group-">
                <unix-def:filepath>/etc/group-</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
                <ind-def:filepath>/etc/system-release-cpe</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
                <lin-def:name operation="pattern match">fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-object_etc_system_fips:obj:1" version="1">
                <unix-def:filepath>/etc/system-fips</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_selinux_config:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^SELINUX=(.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins_exists:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limitsd_conf_maxlogins:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_security_limits_conf_maxlogins:obj:1" version="1">
                <ind-def:filepath>/etc/security/limits.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:(?:hard)|(?:-))[\s]+maxlogins[\s]+(\d+)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_securetty_exists:obj:1" version="1" comment="/etc/securetty file exists">
                <ind-def:filepath>/etc/securetty</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_profiled_tmout:obj:1" version="3">
                <ind-def:path>/etc/profile.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.sh$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_profile_tmout:obj:1" version="3">
                <ind-def:filepath>/etc/profile</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*TMOUT=([\w$]+).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_passwd_entries:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!root).*:x:([\d]+):[\d]+:[^:]*:[^:]*:(?!\/usr\/sbin\/nologin|\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt|\/bin\/false|\/usr\/bin\/false).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_passwd_content:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([^:]+):.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_libuser_conf_cryptstyle:obj:1" version="1" comment="The password hashing algorithm should be set correctly in /etc/libuser.conf">
                <ind-def:filepath>/etc/libuser.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*crypt_style[\s]+=[\s]+(?i)sha512[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1">
                <ind-def:filepath>/etc/default/useradd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*INACTIVE\s*=\s*(\d+)\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" version="1" comment="gpgcheck set in /etc/dnf/dnf.conf">
                <ind-def:filepath>/etc/dnf/dnf.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*gpgcheck\s*=\s*1\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_syscall_audit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+task,never[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_enable_dracut_fips_module:obj:1" version="1">
                <ind-def:filepath>/etc/dracut.conf.d/40-fips.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*add_dracutmodules\+="\s*(\w*)\s*"\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:symlink_object id="oval:ssg-object_disable_xwindows_runlevel_target:obj:1" version="1" comment="default.target systemd softlink exists">
                <unix-def:filepath>/etc/systemd/system/default.target</unix-def:filepath>
              </unix-def:symlink_object>
              <unix-def:symlink_object id="oval:ssg-object_disable_ctrlaltdel_exists:obj:1" version="1" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:filepath>/etc/systemd/system/ctrl-alt-del.target</unix-def:filepath>
              </unix-def:symlink_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_directory_acccess_var_log_audit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_dir_ownership_lib_dir:obj:1" version="1" comment="library directories">
                <unix-def:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_owner_library_dirs_not_root:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_dir_group_ownership_lib_dir:obj:1" version="1" comment="library directories">
                <unix-def:path operation="pattern match">(^\/lib(|64)\/|^\/usr\/lib(|64)\/)</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_group_owner_library_dirs_not_root:ste:1</filter>
              </unix-def:file_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_nosuid_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_noexec_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_dev_shm_partition_nodev_optional_no:obj:1" version="1">
                <lin-def:mount_point>/dev/shm</lin-def:mount_point>
              </lin-def:partition_object>
              <unix-def:file_object id="oval:ssg-object_dev_device_files:obj:1" version="1" comment="device files within /dev directory">
                <unix-def:behaviors recurse_direction="down"/>
                <unix-def:path>/dev</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_block_or_char_device_file:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_defaultkernel_sysconfig_kernel:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/kernel</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*DEFAULTKERNEL[\s]*=[\s]*kernel-PAE$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1">
                <unix-def:filepath>/etc/crypto-policies/back-ends/nss.config</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:variable_object id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1" comment="Crypto policy current file timestamp">
                <ind-def:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_cron_daily_logrotate_existence:obj:1" version="1">
                <ind-def:filepath>/etc/cron.daily/logrotate</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-object_count_of_suid_sgid_binaries_on_system:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/proc/cmdline</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^BOOT_IMAGE(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^options (.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/boot/loader/entries/ostree-1-.*.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^options (.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:obj:1" version="1">
                <unix-def:filepath operation="pattern match">^/boot/loader/entries/ostree-2-.*.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limitsconf:obj:1" version="1">
                <ind-def:filepath>/etc/security/limits.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d_exists:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_core_dumps_limits_d:obj:1" version="1">
                <ind-def:path>/etc/security/limits.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\d]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/sshd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*CRYPTO_POLICY\s*=.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/pki/tls/openssl.cnf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_opensc_nss_db:obj:1" version="1">
                <ind-def:filepath>/etc/pki/nssdb/pkcs11.txt</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^library=opensc.*.so$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_opensc_card_drivers:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/opensc.*.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]+card_drivers[\s]+=[\s]+(\S+);$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_mount_option_var_tmp_bind_tmp:obj:1" version="1" comment="look for the partition mount point in /etc/mtab">
                <ind-def:filepath>/etc/fstab</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*/tmp[\s]+/var/tmp[\s]+.*bind.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/ipsec.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*include\s+/etc/crypto-policies/back-ends/libreswan.config\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/state/current</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#)(\S+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!#)(\S+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/named.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*include\s+"/etc/crypto-policies/back-ends/bind.config"\s*;\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_remote_server:obj:1" version="1" comment="Ensure at least one NTP server is set">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?:server|pool)[\s]+.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_chronyd_multiple_servers:obj:1" version="1" comment="Ensure more than one chronyd NTP server is set">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_unique_superuser:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)(?!root|admin|administrator)(?-i).*"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_unique_superuser:obj:1" version="1">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers="(?i)(?!root|admin|administrator)(?-i).*"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_uefi_superuser:obj:1" version="2">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_superuser:obj:1" version="2">
                <ind-def:filepath>/boot/grub2/grub.cfg</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_bootloader_disable_recovery_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*GRUB_DISABLE_RECOVERY=(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_nosuid_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_noexec_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_nodev_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <lin-def:partition_object id="oval:ssg-object_boot_partition_noauto_optional_yes:obj:1" version="1">
                <lin-def:mount_point>/boot</lin-def:mount_point>
              </lin-def:partition_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_banner_etc_motd:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath>/etc/motd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_banner_etc_issue:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath operation="pattern match">^/etc/issue(\.d/.*)?$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_percentage:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*space_left[\s]+=[\s]+(\d+)%[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_space_left_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_num_logs:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*num_logs[ ]+=[ ]+(\d+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*max_log_file_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_max_log_file:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*max_log_file[ ]+=[ ]+(\d+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_flush:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*flush[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_admin_space_left_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*admin_space_left_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_full_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_data_disk_error_action:obj:1" version="2">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_root:obj:1" version="1" comment="log_group = root">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*log_group[ ]+=[ ]+root[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_conf_log_group_is_set:obj:1" version="1" comment="log_group is set">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*log_group[ ]+=.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_syslog_plugin_activated:obj:1" version="1">
                <ind-def:filepath>/etc/audit/plugins.d/syslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*active[ ]+=[ ]+yes[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_encrypt_sent_records:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audisp-remote.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*transport[ ]+=[ ]+KRB5[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_auditd_audispd_configure_remote_server:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audisp-remote.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ ]*remote_server[ ]+=[ ]+(\S+)[ ]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_shadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_opasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/security\/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_gshadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_group_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+\/etc\/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_shadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/shadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/security/opasswd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/passwd[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_gshadow_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/gshadow[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_augen:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s+]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_usergroup_modification_etc_group_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/group[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)\w+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_shadow_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_passwd_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_gshadow_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_openat_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_64bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_tc_group_open_32bit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_d_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_sysadmin_actions_sudoers_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_usernetctl_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/usernetctl[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_userhelper_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/userhelper[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_unix_chkpwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/unix_chkpwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_umount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/umount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudoedit_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudoedit[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_sudo_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/sudo[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_su_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/su[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_ssh_keysign_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/openssh\/ssh-keysign[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_pt_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/libexec\/pt_chown[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_passwd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/passwd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newuidmap_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newuidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgrp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgrp[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_newgidmap_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/newgidmap[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_gpasswd_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/gpasswd[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_crontab_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/crontab[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chsh_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chsh[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_chage_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_privileged_commands_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/at[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_seunshare_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/seunshare[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_semanage_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/semanage[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_restorecon_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/restorecon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon[\s]+-F[\s]+auid&gt;=1000[\s]+-F[\s]+auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_augenrules:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/auditd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/augenrules.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_audit_rules_auditctl:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/auditd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStartPost=\-\/sbin\/auditctl.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_artw_etc_localtime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_wtmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_wtmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/wtmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_utmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_utmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/run/utmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_btmp_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arse_btmp_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+/var/log/btmp\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a always,exit (?:-F path=([\S]+) )+-F auid&gt;=1000 -F auid!=(?:4294967295|unset)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_sysconfig_network_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/sysconfig/network[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_net_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue\.net[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_issue_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/issue[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arnm_etc_hosts_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/hosts[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_armm_selinux_watch_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w[\s]+/etc/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b[\s]+(-k[\s]+|-F[\s]+key=)[-\w]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_tallylog_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/log\/tallylog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_tallylog_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/log\/tallylog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_lastlog_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/log\/lastlog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_lastlog_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/log\/lastlog\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_faillock_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/run\/faillock\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_arle_faillock_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-w\s+\/var\/run\/faillock\s+\-p\s+wa\s+(-k[\s]+|-F[\s]+key=)[-\w]+\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ari_locked_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-e\s+2\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_ari_locked_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\-e\s+2\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_rsyslogd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/rsyslogd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_autrace:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/autrace\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_ausearch:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/ausearch\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_aureport:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/aureport\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_augenrules:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/augenrules\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_auditd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/auditd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\/usr\/sbin\/auditctl\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_verify_audispd:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^/usr/sbin/audispd\s+([^\n]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_var_cron_checking:obj:1" version="1" comment="run aide with cron">
                <ind-def:filepath>/var/spool/cron/root</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_operational_database_filename:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^database=file:@@{DBDIR}/([a-z.]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_aide_operational_database_absolute_path:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-variable_aide_operational_database_absolute_path:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_crontabs_checking:obj:1" version="1" comment="run aide with cron.(daily|weekly)">
                <ind-def:path operation="pattern match">^/etc/cron.(daily|weekly)$</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\/usr\/sbin\/aide[\s]*\-\-check.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_build_new_database_filename:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^database_out=file:@@{DBDIR}/([a-z.]+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_aide_build_new_database_absolute_path:obj:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" var_check="at least one"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_aide_build_database_dirpath:obj:1" version="1">
                <ind-def:filepath>/etc/aide.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^@@define[\s]DBDIR[\s]+(/.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:environmentvariable58_object id="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" version="1">
                <ind-def:pid xsi:nil="true" datatype="int"/>
                <ind-def:name>PATH</ind-def:name>
              </ind-def:environmentvariable58_object>
              <unix-def:file_object id="oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1" version="1" comment="root's path directories with wrong group / other write permissions">
                <unix-def:path var_ref="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" var_check="at least one"/>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1</filter>
                <filter>oval:ssg-state_accounts_root_path_dirs_symlink:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1" version="1" comment="Is pam_faillock not skipped?">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_system-auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1" version="1" comment="Is pam_faillock not skipped?">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_password-auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1" version="2">
                <set>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_system-auth:obj:1</object_reference>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1" version="2">
                <set>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1</object_reference>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_password-auth:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1" version="2">
                <set>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system-auth:obj:1</object_reference>
                  <object_reference>oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password-auth:obj:1</object_reference>
                </set>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_system-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=(\w*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_unlock_time_password-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*unlock_time=(\w*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+required[\s]+pam_faillock\.so[\s]+preauth[\s]+[^\n]*silent[\s]+[^\n]*deny=([0-9]+)[\s]*(?s).*[\n][\s]*auth[^\n]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_system-auth:obj:1" version="1" comment="Get number of lines pam_unix defaults to">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+\[.*default=([0-9]+).*\][\s]+pam_unix\.so</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_password-auth:obj:1" version="1" comment="Get number of lines pam_unix defaults to">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+\[[^\]]*default=([0-9]+)[^\]]*\][\s]+pam_unix\.so</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_system-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:required))\s+pam_faillock\.so\s+preauth.*fail_interval=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_fail_interval_password-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_system-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=(\w*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_unlock_time_password-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*unlock_time=(\w*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*auth\s+(?:(?:sufficient)|(?:\[default=die\]))\s+pam_faillock\.so\s+authfail.*fail_interval=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[[^\]]*default=ignore[^\]]*\]))[^\n]+pam_unix\.so(?:.*[\n])*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[^\n]+deny=([0-9]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*auth[\s]+(?:(?:sufficient)|(?:\[[^\]]*default=ignore[[^\]]*\]))[\s]+pam_unix\.so(?:.*[\n])*[^\n]*auth[\s]+\[default=die\][\s]+pam_faillock\.so[\s]+authfail[\s]+[^\n]*deny=([0-9]+)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_system-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*account\s+required\s+pam_faillock\.so.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_requires_password-auth:obj:1" version="2">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*account\s+required\s+pam_faillock\.so.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">[\n][\s]*account[\s]+required[\s]+pam_faillock\.so[^\n]*[\n][\s]*account[\s]+required[\s]+pam_unix\.so[^\n]*[\n]</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:sufficient)|(?:required))\s+pam_unix\.so.*remember=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:requisite)|(?:required))\s+pam_pwhistory\.so.*remember=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:shadow_object id="oval:ssg-object_accounts_password_all_shadowed_sha512:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
                <filter>oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1</filter>
                <filter>oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1</filter>
              </unix-def:shadow_object>
              <unix-def:password_object id="oval:ssg-object_accounts_password_all_shadowed:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_no_uid_except_root:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?!root:)[^:]*:[^:]*:0</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_logon_fail_delay:obj:1" version="1" comment="FAIL_DELAY value from /etc/login.defs">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)FAIL_DELAY(?-i)[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_accounts_authorized_local_users:obj:1" version="1">
                <ind-def:filepath>/etc/passwd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
                <filter>oval:ssg-state_default_os_user:ste:1</filter>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_settimeofday_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_clock_settime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_art_adjtimex_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b64.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_umount2_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_sethostname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_setdomainname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_init_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_finit_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_delete_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eperm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_truncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_openat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_by_handle_at_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_open_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_ftruncate_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_creat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_arufm_eacces_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_stime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+stime[\s]+|([\s]+|[,])stime([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_settimeofday_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+settimeofday[\s]+|([\s]+|[,])settimeofday([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_clock_settime_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32[\s]+(-S[\s]+clock_settime[\s]+|([\s]+|[,])clock_settime([\s]+|[,]))-F[\s]+a0=(?:0x)?0[\s]+(?:-F[\s]+key=|-k[\s]+)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_art_adjtimex_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b32.*(-S[\s]+adjtimex[\s]+|([\s]+|[,])adjtimex([\s]+|[,])).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount[\s]+|([\s]+|[,])umount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_umount2_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+umount2[\s]+|([\s]+|[,])umount2([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_sethostname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+sethostname[\s]+|([\s]+|[,])sethostname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_setdomainname_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setdomainname[\s]+|([\s]+|[,])setdomainname([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_rename_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_removexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_mount_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+mount[\s]+|([\s]+|[,])mount([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_lchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_init_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+init_module[\s]+|([\s]+|[,])init_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fsetxattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fremovexattr_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_finit_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+finit_module[\s]+|([\s]+|[,])finit_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchownat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmodat_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_fchmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_delete_module_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+delete_module[\s]+|([\s]+|[,])delete_module([\s]+|[,]))).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chown_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/audit/rules\.d/.*\.rules$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1" version="1">
                <ind-def:filepath>/etc/audit/audit.rules</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid&gt;=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
                <ind-def:filepath>/etc/wrlinux-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.8\.0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.10\.19.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_var_tmp_tmp_inst:obj:1" version="1">
                <unix-def:path>/var/tmp/tmp-inst</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_var_tmp_in_namespace_conf:obj:1" version="1">
                <ind-def:filepath>/etc/security/namespace.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*/var/tmp\s+/var/tmp/tmp-inst/\s+level\s+root,adm$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_user_change_lock_delay_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_user_change_idle_delay_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_usbguard_rules_nonempty:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/usbguard/(rules|rules\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\S+.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_profile:obj:1" version="1" comment="Umask value from /etc/profile">
                <ind-def:filepath>/etc/profile</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*umask[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_login_defs:obj:1" version="1" comment="Umask value from /etc/login.defs">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*UMASK[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" version="1" comment="Umask value from /etc/init.d/functions">
                <ind-def:filepath>/etc/init.d/functions</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)UMASK(?-i)[\s]+([^#\s]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_umask_for_daemons:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_init_d_functions_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_tmp_inst:obj:1" version="1">
                <unix-def:path>/tmp/tmp-inst</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_tmp_in_namespace_conf:obj:1" version="1">
                <ind-def:filepath>/etc/security/namespace.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*/tmp\s+/tmp/tmp-inst/\s+level\s+root,adm$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_timer_running_dnf-automatic:obj:1" version="1" comment="Retrieve the ActiveState property of dnf-automatic">
                <lin-def:unit operation="pattern match">dnf-automatic\.timer</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_usbguard_package_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_systemd-coredump_package_systemd_removed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_syslogng_package_syslogng_installed:obj:1" version="1">
                <lin-def:name>syslogng</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_syslog_package_rsyslog_removed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_sssd_package_sssd-common_removed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_sshd_package_openssh-server_removed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rsyslog_package_rsyslog_installed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rsyncd_package_rsync-daemon_removed:obj:1" version="1">
                <lin-def:name>rsync-daemon</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcsvcgssd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcidmapd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rpcgssd_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_rngd_package_rng-tools_installed:obj:1" version="1">
                <lin-def:name>rng-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_pcscd_package_pcsc-lite_installed:obj:1" version="1">
                <lin-def:name>pcsc-lite</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ntpd_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ntp_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_nfslock_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_netfs_package_netfs_removed:obj:1" version="1">
                <lin-def:name>netfs</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_iptables_package_iptables_installed:obj:1" version="1">
                <lin-def:name>iptables</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_ip6tables_package_iptables-ipv6_installed:obj:1" version="1">
                <lin-def:name>iptables-ipv6</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_firewalld_package_firewalld_installed:obj:1" version="1">
                <lin-def:name>firewalld</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_debug-shell_package_systemd_removed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_crond_package_cronie_installed:obj:1" version="1">
                <lin-def:name>cronie</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_cron_package_cron_installed:obj:1" version="1">
                <lin-def:name>cron</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_chronyd_package_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_bluetooth_package_bluez_removed:obj:1" version="1">
                <lin-def:name>bluez</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_autofs_package_autofs_removed:obj:1" version="1">
                <lin-def:name>autofs</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_auditd_package_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_service_atd_package_at_removed:obj:1" version="1">
                <lin-def:name>at</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_xorg-x11-server-common_removed:obj:1" version="1">
                <lin-def:name>xorg-x11-server-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_removed:obj:1" version="1">
                <lin-def:name>vsftpd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vsftpd_installed:obj:1" version="1">
                <lin-def:name>vsftpd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_vim-enhanced_installed:obj:1" version="1">
                <lin-def:name>vim-enhanced</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_usbguard_installed:obj:1" version="1">
                <lin-def:name>usbguard</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tuned_removed:obj:1" version="1">
                <lin-def:name>tuned</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tmux_installed:obj:1" version="1">
                <lin-def:name>tmux</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_telnetd_removed:obj:1" version="1">
                <lin-def:name>telnetd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_telnetd-ssl_removed:obj:1" version="1">
                <lin-def:name>telnetd-ssl</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_tar_installed:obj:1" version="1">
                <lin-def:name>tar</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_syslogng_installed:obj:1" version="1">
                <lin-def:name>syslogng</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sssd-ipa_installed:obj:1" version="1">
                <lin-def:name>sssd-ipa</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-server_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_setroubleshoot-plugins_removed:obj:1" version="1">
                <lin-def:name>setroubleshoot-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_sendmail_removed:obj:1" version="1">
                <lin-def:name>sendmail</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_screen_installed:obj:1" version="1">
                <lin-def:name>screen</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_scap-security-guide_installed:obj:1" version="1">
                <lin-def:name>scap-security-guide</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_samba-common_removed:obj:1" version="1">
                <lin-def:name>samba-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rsyslog_installed:obj:1" version="1">
                <lin-def:name>rsyslog</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rsyslog-gnutls_installed:obj:1" version="1">
                <lin-def:name>rsyslog-gnutls</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rng-tools_installed:obj:1" version="1">
                <lin-def:name>rng-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_rear_installed:obj:1" version="1">
                <lin-def:name>rear</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_prelink_removed:obj:1" version="1">
                <lin-def:name>prelink</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_policycoreutils_installed:obj:1" version="1">
                <lin-def:name>policycoreutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_pcsc-lite_installed:obj:1" version="1">
                <lin-def:name>pcsc-lite</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_pam_ldap_removed:obj:1" version="1">
                <lin-def:name>pam_ldap</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssl-pkcs11_installed:obj:1" version="1">
                <lin-def:name>openssl-pkcs11</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_removed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openssh-server_installed:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openscap-scanner_installed:obj:1" version="1">
                <lin-def:name>openscap-scanner</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_opensc_installed:obj:1" version="1">
                <lin-def:name>opensc</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_openldap-clients_removed:obj:1" version="1">
                <lin-def:name>openldap-clients</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_ntpdate_removed:obj:1" version="1">
                <lin-def:name>ntpdate</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nss-tools_installed:obj:1" version="1">
                <lin-def:name>nss-tools</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nis_removed:obj:1" version="1">
                <lin-def:name>nis</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_nfs-utils_removed:obj:1" version="1">
                <lin-def:name>nfs-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_net-snmp_removed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_mcstrans_removed:obj:1" version="1">
                <lin-def:name>mcstrans</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libselinux_installed:obj:1" version="1">
                <lin-def:name>libselinux</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1">
                <lin-def:name>libreswan</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_libcap-ng-utils_installed:obj:1" version="1">
                <lin-def:name>libcap-ng-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_krb5-workstation_removed:obj:1" version="1">
                <lin-def:name>krb5-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_iptables_installed:obj:1" version="1">
                <lin-def:name>iptables</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_iprutils_removed:obj:1" version="1">
                <lin-def:name>iprutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_inetutils-telnetd_removed:obj:1" version="1">
                <lin-def:name>inetutils-telnetd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gssproxy_removed:obj:1" version="1">
                <lin-def:name>gssproxy</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gnutls-utils_installed:obj:1" version="1">
                <lin-def:name>gnutls-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_geolite2-country_removed:obj:1" version="1">
                <lin-def:name>geolite2-country</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_geolite2-city_removed:obj:1" version="1">
                <lin-def:name>geolite2-city</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gdm_removed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_fapolicyd_installed:obj:1" version="1">
                <lin-def:name>fapolicyd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_esc_installed:obj:1" version="1">
                <lin-def:name>esc</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_dnf-automatic_installed:obj:1" version="1">
                <lin-def:name>dnf-automatic</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_dconf_installed:obj:1" version="1">
                <lin-def:name>dconf</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_cryptsetup-luks_installed:obj:1" version="1">
                <lin-def:name>cryptsetup-luks</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_cron_installed:obj:1" version="1">
                <lin-def:name>cron</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_binutils_installed:obj:1" version="1">
                <lin-def:name>binutils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1">
                <lin-def:name>bind</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_avahi_installed:obj:1" version="1">
                <lin-def:name>avahi</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audit-audispd-plugins_installed:obj:1" version="1">
                <lin-def:name>audit-audispd-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_audispd-plugins_installed:obj:1" version="1">
                <lin-def:name>audispd-plugins</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_aide_installed:obj:1" version="1">
                <lin-def:name>aide</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt_removed:obj:1" version="1">
                <lin-def:name>abrt</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-sosreport_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-sosreport</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-rhtsupport_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-rhtsupport</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-plugin-logger_removed:obj:1" version="1">
                <lin-def:name>abrt-plugin-logger</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-cli_removed:obj:1" version="1">
                <lin-def:name>abrt-cli</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-python_removed:obj:1" version="1">
                <lin-def:name>abrt-addon-python</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-kerneloops_removed:obj:1" version="1">
                <lin-def:name>abrt-addon-kerneloops</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_abrt-addon-ccpp_removed:obj:1" version="1">
                <lin-def:name>abrt-addon-ccpp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_MFEhiplsm_installed:obj:1" version="1">
                <lin-def:name>MFEhiplsm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_package_GConf2_installed:obj:1" version="1">
                <lin-def:name>GConf2</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
                <lin-def:name>postfix</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:variable_object id="oval:ssg-obj_system_crypto_policy_value:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_system_crypto_policy:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sysconfig_nozeroconf_yes:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/network</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*NOZEROCONF[\s]*=[\s]*yes</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_user_value:obj:1" version="1" comment="get last user value from each [sssd] section">
                <ind-def:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[sssd\].*(?:\n\s*[^[\s].*)*\n\s*user[ \t]*=[ \t]*(\S*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_ssh_known_hosts_timeout:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[ssh](?:[^\n\[]*\n+)+?[\s]*ssh_known_hosts_timeout[\s]*=[\s]*(\d+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_offline_cred_expiration:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*offline_credentials_expiration[\s]*=[\s]*1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_memcache_timeout:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[nss](?:[^\n\[]*\n+)+?[\s]*memcache_timeout[\s]*=[\s]*(\d+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_enable_smartcards:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[pam](?:[^\n\[]*\n+)+?[\s]*pam_cert_auth[\s]*=[\s]*true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_enable_certmap:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\^\[certmap\/\.\+\/\.\+\]\$[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sssd_certificate_verification:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/sssd/(sssd|conf\.d/.*)\.conf$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[sssd](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*ocsp_dgst\s*=\s*(\w+)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_x11_use_localhost:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11UseLocalhost(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_use_priv_separation:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)UsePrivilegeSeparation(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_use_directory_configuration_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)match(?-i)\s+\S+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_verbose:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_loglevel_info:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_set_keepalive_0:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)ClientAliveCountMax(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_rekey_limit:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-sshd_line_regex:var:1" var_check="all"/>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_print_last_log:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PrintLastLog(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_includes_config_files:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*Include /etc/ssh/sshd_config\.d/\*\.conf[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_x11_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_warning_banner:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Banner(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_strictmodes:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)StrictModes(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_enable_gssapi_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_do_not_permit_user_env:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_x11_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_user_known_hosts:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreUserKnownHosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_tcp_forwarding:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)AllowTcpForwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_password_login:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_root_login:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_rsa:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)RhostsRSAAuthentication(?-i)[\s]+no[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_rhosts:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_pubkey_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PubkeyAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_kerb_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)KerberosAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_gssapi_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)GSSAPIAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_empty_passwords:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_disable_compression:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)Compression(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">(?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_sshd_clientalivecountmax:obj:1" version="2">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_usbguard:obj:1" version="1" comment="Retrieve the ActiveState property of usbguard">
                <lin-def:unit operation="pattern match">^usbguard\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_syslogng:obj:1" version="1" comment="Retrieve the ActiveState property of syslogng">
                <lin-def:unit operation="pattern match">^syslogng\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_rsyslog:obj:1" version="1" comment="Retrieve the ActiveState property of rsyslog">
                <lin-def:unit operation="pattern match">^rsyslog\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_rngd:obj:1" version="1" comment="Retrieve the ActiveState property of rngd">
                <lin-def:unit operation="pattern match">^rngd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_pcscd:obj:1" version="1" comment="Retrieve the ActiveState property of pcscd">
                <lin-def:unit operation="pattern match">^pcscd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ntpd:obj:1" version="1" comment="Retrieve the ActiveState property of ntpd">
                <lin-def:unit operation="pattern match">^ntpd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ntp:obj:1" version="1" comment="Retrieve the ActiveState property of ntp">
                <lin-def:unit operation="pattern match">^ntp\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_iptables:obj:1" version="1" comment="Retrieve the ActiveState property of iptables">
                <lin-def:unit operation="pattern match">^iptables\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_ip6tables:obj:1" version="1" comment="Retrieve the ActiveState property of ip6tables">
                <lin-def:unit operation="pattern match">^ip6tables\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_firewalld:obj:1" version="1" comment="Retrieve the ActiveState property of firewalld">
                <lin-def:unit operation="pattern match">^firewalld\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_crond:obj:1" version="1" comment="Retrieve the ActiveState property of crond">
                <lin-def:unit operation="pattern match">^crond\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_cron:obj:1" version="1" comment="Retrieve the ActiveState property of cron">
                <lin-def:unit operation="pattern match">^cron\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_chronyd:obj:1" version="1" comment="Retrieve the ActiveState property of chronyd">
                <lin-def:unit operation="pattern match">^chronyd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_running_auditd:obj:1" version="1" comment="Retrieve the ActiveState property of auditd">
                <lin-def:unit operation="pattern match">^auditd\.(socket|service)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_systemd-coredump:obj:1" version="1" comment="Retrieve the ActiveState property of systemd-coredump">
                <lin-def:unit operation="pattern match">^systemd-coredump\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_syslog:obj:1" version="1" comment="Retrieve the ActiveState property of syslog">
                <lin-def:unit operation="pattern match">^syslog\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sssd:obj:1" version="1" comment="Retrieve the ActiveState property of sssd">
                <lin-def:unit operation="pattern match">^sssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_sshd:obj:1" version="1" comment="Retrieve the ActiveState property of sshd">
                <lin-def:unit operation="pattern match">^sshd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rsyncd:obj:1" version="1" comment="Retrieve the ActiveState property of rsyncd">
                <lin-def:unit operation="pattern match">^rsyncd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcsvcgssd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcsvcgssd">
                <lin-def:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcidmapd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcidmapd">
                <lin-def:unit operation="pattern match">^rpcidmapd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_rpcgssd:obj:1" version="1" comment="Retrieve the ActiveState property of rpcgssd">
                <lin-def:unit operation="pattern match">^rpcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfslock:obj:1" version="1" comment="Retrieve the ActiveState property of nfslock">
                <lin-def:unit operation="pattern match">^nfslock\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_nfs-server:obj:1" version="1" comment="Retrieve the ActiveState property of nfs-server">
                <lin-def:unit operation="pattern match">^nfs-server\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_netfs:obj:1" version="1" comment="Retrieve the ActiveState property of netfs">
                <lin-def:unit operation="pattern match">^netfs\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_debug-shell:obj:1" version="1" comment="Retrieve the ActiveState property of debug-shell">
                <lin-def:unit operation="pattern match">^debug-shell\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_bluetooth:obj:1" version="1" comment="Retrieve the ActiveState property of bluetooth">
                <lin-def:unit operation="pattern match">^bluetooth\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_autofs:obj:1" version="1" comment="Retrieve the ActiveState property of autofs">
                <lin-def:unit operation="pattern match">^autofs\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_not_running_atd:obj:1" version="1" comment="Retrieve the ActiveState property of atd">
                <lin-def:unit operation="pattern match">^atd\.(service|socket)$</lin-def:unit>
                <lin-def:property>ActiveState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_systemd-coredump:obj:1" version="1" comment="Retrieve the LoadState property of systemd-coredump">
                <lin-def:unit operation="pattern match">^systemd-coredump\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_syslog:obj:1" version="1" comment="Retrieve the LoadState property of syslog">
                <lin-def:unit operation="pattern match">^syslog\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sssd:obj:1" version="1" comment="Retrieve the LoadState property of sssd">
                <lin-def:unit operation="pattern match">^sssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_sshd:obj:1" version="1" comment="Retrieve the LoadState property of sshd">
                <lin-def:unit operation="pattern match">^sshd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rsyncd:obj:1" version="1" comment="Retrieve the LoadState property of rsyncd">
                <lin-def:unit operation="pattern match">^rsyncd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcsvcgssd:obj:1" version="1" comment="Retrieve the LoadState property of rpcsvcgssd">
                <lin-def:unit operation="pattern match">^rpcsvcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcidmapd:obj:1" version="1" comment="Retrieve the LoadState property of rpcidmapd">
                <lin-def:unit operation="pattern match">^rpcidmapd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_rpcgssd:obj:1" version="1" comment="Retrieve the LoadState property of rpcgssd">
                <lin-def:unit operation="pattern match">^rpcgssd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfslock:obj:1" version="1" comment="Retrieve the LoadState property of nfslock">
                <lin-def:unit operation="pattern match">^nfslock\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1" version="1" comment="Retrieve the LoadState property of nfs-server">
                <lin-def:unit operation="pattern match">^nfs-server\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_netfs:obj:1" version="1" comment="Retrieve the LoadState property of netfs">
                <lin-def:unit operation="pattern match">^netfs\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_debug-shell:obj:1" version="1" comment="Retrieve the LoadState property of debug-shell">
                <lin-def:unit operation="pattern match">^debug-shell\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_bluetooth:obj:1" version="1" comment="Retrieve the LoadState property of bluetooth">
                <lin-def:unit operation="pattern match">^bluetooth\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_autofs:obj:1" version="1" comment="Retrieve the LoadState property of autofs">
                <lin-def:unit operation="pattern match">^autofs\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <lin-def:systemdunitproperty_object id="oval:ssg-obj_service_loadstate_is_masked_atd:obj:1" version="1" comment="Retrieve the LoadState property of atd">
                <lin-def:unit operation="pattern match">^atd\.(service|socket)$</lin-def:unit>
                <lin-def:property>LoadState</lin-def:property>
              </lin-def:systemdunitproperty_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_selinux_policy:obj:1" version="1">
                <ind-def:filepath>/etc/selinux/config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^SELINUXTYPE=([\w]*)[\s]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_mode_blank:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?picture-uri=(string[\s])?\'\'$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-enabled=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^lock-delay[\s=]*uint32[\s]([^=\s]*)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_lock_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^idle-delay[\s=]*uint32[\s]([^=\s]*)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/session]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_idle_activation_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?idle-activation-enabled=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_screensaver_disable_user_info:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/screensaver]([^\n]*\n+)+?show-full-name-in-top-bar=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls_cacert:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*global\(DefaultNetstreamDriverCAFile="(.+?)"\)\s*\n</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">0</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_remote_tls:obj:1" version="1">
                <ind-def:behaviors singleline="true"/>
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*action\((?i)type(?-i)="omfwd"(.+?)\)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">0</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:obj:1" version="1" comment="Check if $DefaultNetstreamDriver gtls is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:obj:1" version="1" comment="Check if  $DefaultNetstreamDriver gtls is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$DefaultNetstreamDriver gtls$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:obj:1" version="1" comment="Check if  $ActionSendStreamDriverMode 1 is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverMode 1$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:obj:1" version="1" comment="Check if $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.d">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:obj:1" version="1" comment="Check if  $ActionSendStreamDriverAuthMode x509/name is set in /etc/rsyslog.conf">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\$ActionSendStreamDriverAuthMode x509/name$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_root_mail_alias:obj:1" version="1">
                <ind-def:filepath>/etc/aliases</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:[rR][oO][oO][tT]|"[rR][oO][oO][tT]")\s*:\s*(.+)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhosp13_release:obj:1" version="1">
                <lin-def:name>rhosp-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhosp10_release:obj:1" version="1">
                <lin-def:name>rhosp-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
                <lin-def:name>rhvm-appliance</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
                <lin-def:name>redhat-release-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
                <lin-def:name>redhat-release-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
                <lin-def:name>redhat-release-computenode</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
                <lin-def:name>redhat-release-client</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_rescue_service_runlevel1:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/runlevel1.target</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Requires=.*rescue.service</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_rescue_service:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/rescue.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_emergency_service_emergency:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/emergency.target</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Requires=.*emergency.service</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_require_emergency_service:obj:1" version="1">
                <ind-def:filepath>/usr/lib/systemd/system/emergency.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ExecStart=\-/usr/lib/systemd/systemd-sulogin-shell[\s]+emergency</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_daemon:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*daemon\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_authpriv:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*authpriv\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_remote_method_monitoring_auth:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*auth\.\*.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_user-administration-disabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_sys_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/system/location/enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_mode_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/picture-uri$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock_locked:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_screensaver_lock:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_removal-action:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_encryption:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/Vino/require-encryption$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_remote_access_creds:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/Vino/authentication-methods$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_power_setting_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/power/active$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_lock_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/lock-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_info_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_autorun:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/autorun-never$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount_open:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount-open$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_gnome_automount:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/media-handling/automount$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_notification:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/nm-applet/suppress-wireless-networks-available$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_wifi_creation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/nm-applet/disable-wifi-create$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_restart_buttons:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/disable-restart-buttons$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_enable_ctrlaltdel:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/settings-daemon/plugins/media-keys/logout$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_user_list:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/disable-user-list$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_disable_smartcard:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/enable-smartcard-authentication$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_clock_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/clocks/geolocation$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_delay:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/session/idle-delay$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_locked:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_idle_activation_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/screensaver/idle-activation-enabled$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_change_gnome_thumbnailers:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/desktop/thumbnailers/disable-all$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_gui_enabled_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-enable$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_banner_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/banner-message-text$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_prevent_user_allowed-failures_change:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/locks/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^/org/gnome/login-screen/allowed-failures$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ucredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_ocredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ocredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^minlen[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_minclass:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^minclass[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxrepeat:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^maxrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_maxclassrepeat:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^maxclassrepeat[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^lcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_difok:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^difok[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dictcheck:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^dictcheck[\s]*=[\s]*(\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^dcredit[\s]*=[\s]*(-?\d+)(?:[\s]|$)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1">
                <ind-def:filepath var_ref="oval:ssg-var_pam_pwquality_config_path:var:1" var_check="at least one"/>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_package_kernel-PAE_installed:obj:1" version="1">
                <lin-def:name>kernel-PAE</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_openssh-server_version:obj:1" version="1">
                <lin-def:name>openssh-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_systemd:obj:1" version="1" comment="check /usr/lib/systemd/system/ntpd.service">
                <ind-def:filepath>/usr/lib/systemd/system/ntpd.service</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*ExecStart=.*-u ntp:ntp.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:obj:1" version="1" comment="check /etc/sysconfig/ntpd">
                <ind-def:filepath>/etc/sysconfig/ntpd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*OPTIONS=.*-u ntp:ntp.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_multiple_servers:obj:1" version="1" comment="Ensure more than one ntpd NTP server is set">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^([\s]*server[\s]+.+$){2,}$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_configure_restrictions_ipv6:obj:1" version="1" comment="ensure ipv6 restrictions">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*restrict[\s]+-6[\s]+default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntpd_configure_restrictions_ipv4:obj:1" version="1" comment="ensure ipv4 restrictions">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*restrict[\s]+(-4[\s]*)?default(?=.*kod)(?=.*nomodify)(?=.*notrap)(?=.*nopeer)(?=.*noquery).*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_set_maxpoll:obj:1" version="1">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_remote_server:obj:1" version="1" comment="Ensure at least one ntpd NTP server is set">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*server[\s]+.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ntp_all_server_has_maxpoll:obj:1" version="1">
                <ind-def:filepath>/etc/ntp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_noexec_cmd_line:obj:1" version="1">
                <ind-def:filepath>/proc/cmdline</ind-def:filepath>
                <ind-def:pattern operation="pattern match">.+noexec[0-9]*=off.+</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_no_tmux_in_shells:obj:1" version="1">
                <ind-def:filepath>/etc/shells</ind-def:filepath>
                <ind-def:pattern operation="pattern match">tmux$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_no_insecure_locks_exports:obj:1" version="2">
                <ind-def:filepath>/etc/exports</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*?(\binsecure_locks\b)[^$]*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_static_address:obj:1" version="1" comment="Set static IPv6 address on each interface">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6ADDR=.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_privacy_extensions:obj:1" version="1" comment="Enable privacy extensions on each interface">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6_PRIVACY=rfc3041$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_disable_rpc_udp6:obj:1" version="1" comment="Test for udp6 based rpc services">
                <ind-def:filepath>/etc/netconfig</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^udp6\s+tpi_clts\s+v\s+inet6\s+udp\s+-\s+-$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_disable_rpc_tcp6:obj:1" version="1" comment="Test for tcp6 based rpc services">
                <ind-def:filepath>/etc/netconfig</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^tcp6\s+tpi_cots_ord\s+v\s+inet6\s+tcp\s+-\s+-$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_network_ipv6_default_gateway:obj:1" version="1" comment="Define default gateways">
                <ind-def:path>/etc/sysconfig/network-scripts</ind-def:path>
                <ind-def:filename operation="pattern match">ifcfg-.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^IPV6_DEFAULTGW=.+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_messages_nx_active:obj:1" version="1">
                <ind-def:filepath>/var/log/messages</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.+protection: disabled.+</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_mcafee_runtime_installed:obj:1" version="1">
                <lin-def:name>MFErt</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_mcafee_management_agent:obj:1" version="1">
                <lin-def:name>MFEcma</lin-def:name>
              </lin-def:rpminfo_object>
              <unix-def:file_object id="oval:ssg-obj_lsb:obj:1" version="1" comment="check /etc/lsb-release file">
                <unix-def:filepath>/etc/lsb-release</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_linuxshield_install_antivirus:obj:1" version="1">
                <lin-def:name>McAfeeVSEForLinux</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_runmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of vfat">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_libmodprobed:obj:1" version="1" comment="kernel module vfat disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_etcmodules-load:obj:1" version="1" comment="kernel module vfat disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_vfat_disabled:obj:1" version="1" comment="kernel module vfat disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+vfat\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_runmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of usb-storage">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_libmodprobed:obj:1" version="1" comment="kernel module usb-storage disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_etcmodules-load:obj:1" version="1" comment="kernel module usb-storage disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_usb-storage_disabled:obj:1" version="1" comment="kernel module usb-storage disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodules-load:obj:1" version="1" comment="kernel module udf disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_runmodprobed:obj:1" version="1" comment="kernel module udf disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of udf">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodules-load:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_libmodprobed:obj:1" version="1" comment="kernel module udf disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_etcmodules-load:obj:1" version="1" comment="kernel module udf disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_udf_disabled:obj:1" version="1" comment="kernel module udf disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+udf\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_runmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of tipc">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_libmodprobed:obj:1" version="1" comment="kernel module tipc disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_etcmodules-load:obj:1" version="1" comment="kernel module tipc disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_tipc_disabled:obj:1" version="1" comment="kernel module tipc disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+tipc\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_runmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of squashfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_libmodprobed:obj:1" version="1" comment="kernel module squashfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_etcmodules-load:obj:1" version="1" comment="kernel module squashfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_squashfs_disabled:obj:1" version="1" comment="kernel module squashfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+squashfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodules-load:obj:1" version="1" comment="kernel module rds disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_runmodprobed:obj:1" version="1" comment="kernel module rds disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of rds">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodules-load:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_libmodprobed:obj:1" version="1" comment="kernel module rds disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_etcmodules-load:obj:1" version="1" comment="kernel module rds disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_rds_disabled:obj:1" version="1" comment="kernel module rds disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+rds\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_runmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of jffs2">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_libmodprobed:obj:1" version="1" comment="kernel module jffs2 disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_etcmodules-load:obj:1" version="1" comment="kernel module jffs2 disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_jffs2_disabled:obj:1" version="1" comment="kernel module jffs2 disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+jffs2\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_runmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfsplus">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_libmodprobed:obj:1" version="1" comment="kernel module hfsplus disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_etcmodules-load:obj:1" version="1" comment="kernel module hfsplus disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfsplus_disabled:obj:1" version="1" comment="kernel module hfsplus disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfsplus\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_runmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of hfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_libmodprobed:obj:1" version="1" comment="kernel module hfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_etcmodules-load:obj:1" version="1" comment="kernel module hfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_hfs_disabled:obj:1" version="1" comment="kernel module hfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+hfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_runmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of freevxfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_libmodprobed:obj:1" version="1" comment="kernel module freevxfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_etcmodules-load:obj:1" version="1" comment="kernel module freevxfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_freevxfs_disabled:obj:1" version="1" comment="kernel module freevxfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+freevxfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_runmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of firewire-core">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_libmodprobed:obj:1" version="1" comment="kernel module firewire-core disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_etcmodules-load:obj:1" version="1" comment="kernel module firewire-core disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_firewire-core_disabled:obj:1" version="1" comment="kernel module firewire-core disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+firewire-core\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_runmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of dccp">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_libmodprobed:obj:1" version="1" comment="kernel module dccp disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_etcmodules-load:obj:1" version="1" comment="kernel module dccp disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_dccp_disabled:obj:1" version="1" comment="kernel module dccp disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+dccp\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_runmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of cramfs">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_libmodprobed:obj:1" version="1" comment="kernel module cramfs disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_etcmodules-load:obj:1" version="1" comment="kernel module cramfs disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_cramfs_disabled:obj:1" version="1" comment="kernel module cramfs disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+cramfs\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodules-load:obj:1" version="1" comment="kernel module can disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_runmodprobed:obj:1" version="1" comment="kernel module can disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of can">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodules-load:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_libmodprobed:obj:1" version="1" comment="kernel module can disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_etcmodules-load:obj:1" version="1" comment="kernel module can disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_can_disabled:obj:1" version="1" comment="kernel module can disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+can\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_runmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of bluetooth">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_libmodprobed:obj:1" version="1" comment="kernel module bluetooth disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_etcmodules-load:obj:1" version="1" comment="kernel module bluetooth disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_bluetooth_disabled:obj:1" version="1" comment="kernel module bluetooth disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+bluetooth\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodules-load:obj:1" version="1" comment="kernel module atm disabled in /run/modules-load.d">
                <ind-def:path>/run/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_runmodprobed:obj:1" version="1" comment="kernel module atm disabled in /run/modprobe.d">
                <ind-def:path>/run/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_modprobeconf:obj:1" version="1" comment="Check deprecated /etc/modprobe.conf for disablement of atm">
                <ind-def:filepath>/etc/modprobe.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodules-load:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modules-load.d">
                <ind-def:path>/usr/lib/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_libmodprobed:obj:1" version="1" comment="kernel module atm disabled in /usr/lib/modprobe.d">
                <ind-def:path>/usr/lib/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_etcmodules-load:obj:1" version="1" comment="kernel module atm disabled in /etc/modules-load.d">
                <ind-def:path>/etc/modules-load.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_kernmod_atm_disabled:obj:1" version="1" comment="kernel module atm disabled">
                <ind-def:path>/etc/modprobe.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*install\s+atm\s+(/bin/false|/bin/true)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_kerberos_disable_no_keytab:obj:1" version="1" comment="Default Kerberos keytab file">
                <unix-def:filepath operation="pattern match">^/etc/.+\.keytab$</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_macs_openssh_conf_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/openssh.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^MACs.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/opensshserver.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(?:.*\n)*\s*CRYPTO_POLICY=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_sshd_ciphers_openssh_conf_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/openssh.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Ciphers.*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_RekeyLimit:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*RekeyLimit[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*PubkeyAcceptedKeyTypes[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Match:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*Match[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_MACs:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*MACs[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_KexAlgorithms:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*KexAlgorithms[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_GSSAPIAuthentication:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*GSSAPIAuthentication[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_harden_ssh_client_crypto_policy_Ciphers:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/ssh_config.d/02-ospp.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Match final all(?:.*
)*?\s*Ciphers[\s]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_grub2_nousb_argument:obj:1" version="1">
                <ind-def:filepath>/etc/default/grub</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*GRUB_CMDLINE_LINUX=([^#]*).*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp_config_file:obj:1" version="1" comment="The configuration file /etc/gdm/custom.conf for gnome_gdm_disable_xdmcp">
                <unix-def:filepath operation="pattern match">^/etc/gdm/custom.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gnome_gdm_disable_xdmcp:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[xdmcp\].*(?:\n\s*[^[\s].*)*\n^\s*Enable[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gnome_disable_thumbnailers:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/thumbnailers]([^\n]*\n+)+?disable-all=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_gdm_login_banner_text_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^banner-message-text=[\s]*'*(.*?)'$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_firewalld_input_drop:obj:1" version="1">
                <ind-def:filepath>/etc/firewalld/firewalld.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DefaultZone=drop$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_suid_unowned:obj:1" version="1" comment="files with suid set which are not owned by any RPM package">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" version="1" comment="all files with suid set that come from a RPM package">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" var_check="all"/>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" version="1" comment="all files with suid set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_unowned:obj:1" version="1" comment="files with sgid set which are not owned by any RPM package">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</filter>
                <filter>oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpmverifyfile_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" version="1" comment="all files with sgid set that come from a RPM package">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true"/>
                <lin-def:name operation="pattern match">.*</lin-def:name>
                <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
                <lin-def:version operation="pattern match">.*</lin-def:version>
                <lin-def:release operation="pattern match">.*</lin-def:release>
                <lin-def:arch operation="pattern match">.*</lin-def:arch>
                <lin-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" var_check="all"/>
              </lin-def:rpmverifyfile_object>
              <unix-def:file_object id="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" version="1" comment="all files with sgid set">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">^.*$</unix-def:filename>
                <filter action="include">oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1</filter>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
                <lin-def:name>s390utils-base</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
                <lin-def:name>yum</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
                <lin-def:name>pam</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
                <lin-def:name>nss-pam-ldapd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
                <lin-def:name>shadow-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
                <lin-def:name>libuser</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
                <lin-def:name>grub2-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1">
                <ind-def:path>/etc/yum.repos.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*gpgcheck\s*=\s*0\s*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_enable_pam_namespace:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/login</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_namespace\.so\s*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_enable_gnome_smartcard:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?enable-smartcard-authentication=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dnf-automatic_security_updates_only_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_security_updates_only">
                <unix-def:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_security_updates_only:obj:1" version="1">
                <ind-def:filepath>/etc/dnf/automatic.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*upgrade_type[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dnf-automatic_apply_updates_config_file:obj:1" version="1" comment="The configuration file /etc/dnf/automatic.conf for dnf-automatic_apply_updates">
                <unix-def:filepath operation="pattern match">^/etc/dnf/automatic.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dnf-automatic_apply_updates:obj:1" version="1">
                <ind-def:filepath>/etc/dnf/automatic.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[commands\].*(?:\n\s*[^[\s].*)*\n^\s*apply_updates[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_display_login_attempts_silent:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/postlogin</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog.so[\s\w\d\=]+silent(\s|$)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_display_login_attempts:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/postlogin</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*session\s+required\s+pam_lastlog.so[\s\w\d\=]+showfailed(\s|$)</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_wifi_notification:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?suppress-wireless-networks-available=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_wifi_creation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/nm-applet]([^\n]*\n+)+?disable-wifi-create=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_user_list:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-user-list=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_sys_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/system/location]([^\n]*\n+)+?enabled=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_restart_buttons:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?disable-restart-buttons=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir_default_not_overriden:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth_config_dir:obj:1" version="1">
                <ind-def:path>/etc/ssh/sshd_config.d</ind-def:path>
                <ind-def:filename operation="pattern match">.*\.conf$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_host_auth:obj:1" version="1">
                <ind-def:filepath>/etc/ssh/sshd_config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_guest_login:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?TimedLoginEnable=[Ff]alse$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_gnome_power_setting:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/power]([^\n]*\n+)+?active=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_gnome_ctrlaltdel:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/settings-daemon/plugins/media-keys]([^\n]*\n+)+?logout[\s]*=[\s]*''$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_clock_geolocation:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/clocks]([^\n]*\n+)+?geolocation=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_disable_automatic_login:obj:1" version="1">
                <ind-def:filepath>/etc/gdm/custom.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\[daemon]([^\n]*\n+)+?AutomaticLoginEnable=[Ff]alse$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^9.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^10.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_debian:obj:1" version="1" comment="check /etc/debian_version file">
                <unix-def:filepath>/etc/debian_version</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_user_profile:obj:1" version="2">
                <ind-def:filepath>/etc/dconf/profile/user</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^user-db:user\nsystem-db:local$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_local_db:obj:1" version="1" comment="The binary system-wide dconf database with 'local' settings">
                <unix-def:filepath>/etc/dconf/db/local</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-obj_dconf_local_config:obj:1" version="1" comment="The dconf keyfile with 'local' settings">
                <unix-def:filepath operation="pattern match">^/etc/dconf/db/local.d/.*</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_lock_screen_on_smartcard_removal:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\[org/gnome/settings-daemon/peripherals/smartcard\].*(?:\n\s*[^[\s].*)*\n^\s*removal-action[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_user_admin:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\s*\[org/gnome/desktop/lockdown\].*(?:\n\s*[^[\s].*)*\n^\s*user-administration-disabled[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_autorun:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?autorun-never=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount_open:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount-open=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_dconf_gnome_disable_automount:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/desktop/media-handling\]([^\n]*\n+)+?automount=false$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog_dir:obj:1" version="1">
                <ind-def:path>/etc/rsyslog.d</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_cron_logging_rsyslog:obj:1" version="1">
                <ind-def:filepath>/etc/rsyslog.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*cron\.\*[\s]+/var/log/cron$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:variable_object id="oval:ssg-obj_count_of_all_uids:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-variable_count_of_all_uids:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_coredump_disable_storage:obj:1" version="1">
                <ind-def:filepath>/etc/systemd/coredump.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_coredump_disable_backtraces:obj:1" version="1">
                <ind-def:filepath>/etc/systemd/coredump.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_configure_usbguard_auditbackend_config_file:obj:1" version="1" comment="The configuration file /etc/usbguard/usbguard-daemon.conf for configure_usbguard_auditbackend">
                <unix-def:filepath operation="pattern match">^/etc/usbguard/usbguard-daemon.conf</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_usbguard_auditbackend:obj:1" version="1">
                <ind-def:filepath>/etc/usbguard/usbguard-daemon.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*AuditBackend=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_command:obj:1" version="1">
                <ind-def:filepath>/etc/tmux.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*set\s+-g\s+lock-command\s+vlock\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_tmux_lock_after_time:obj:1" version="1">
                <ind-def:filepath>/etc/tmux.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*set\s+-g\s+lock-after-time\s+900\s*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_encryption:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?require-encryption=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_remote_access_creds:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/local.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/Vino]([^\n]*\n+)+?authentication-methods=\['vnc'\]$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_gnutls_tls_crypto_policy:obj:1" version="1">
                <ind-def:filepath>/etc/crypto-policies/back-ends/gnutls.config</ind-def:filepath>
                <ind-def:pattern operation="pattern match">\+VERS-ALL:-VERS-DTLS0\.9:-VERS-SSL3\.0:-VERS-TLS1\.0:-VERS-TLS1\.1:-VERS-DTLS1\.0</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_bashrc_exec_tmux:obj:1" version="1">
                <ind-def:behaviors singleline="true" multiline="false"/>
                <ind-def:filepath>/etc/bashrc</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^(.*)$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_configure_allowed_failures:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?allowed-failures=3$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_chronyd_run_as_chrony_user_config_file:obj:1" version="1" comment="The configuration file /etc/sysconfig/chronyd for chronyd_run_as_chrony_user">
                <unix-def:filepath operation="pattern match">^/etc/sysconfig/chronyd</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_run_as_chrony_user:obj:1" version="1">
                <ind-def:filepath>/etc/sysconfig/chronyd</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*OPTIONS=(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_port_value:obj:1" version="1">
                <ind-def:filepath>/etc/chrony.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*port[\s]+(\S+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chronyd_cmdport_value:obj:1" version="1">
                <ind-def:filepath>/etc/chrony.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*cmdport[\s]+(\S+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chrony_set_maxpoll:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+.*maxpoll[\s]+(\d+)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_chrony_all_server_has_maxpoll:obj:1" version="1">
                <ind-def:filepath operation="pattern match">^/etc/chrony\.(conf|d/.+\.conf)$</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^server[\s]+[\S]+[\s]+(.*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_banner_gui_enabled:obj:1" version="1">
                <ind-def:path>/etc/dconf/db/distro.d/</ind-def:path>
                <ind-def:filename operation="pattern match">^.*$</ind-def:filename>
                <ind-def:pattern operation="pattern match">^\[org/gnome/login-screen]([^\n]*\n+)+?banner-message-enable=true$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_write_logs:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)write_logs(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_overflow_action:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)overflow_action(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_name_format:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)name_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_log_format:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)log_format(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_local_events_default_not_overriden:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_local_events:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)local_events(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_auditd_freq:obj:1" version="1">
                <ind-def:filepath>/etc/audit/auditd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[ \t]*(?i)freq(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:password_object id="oval:ssg-obj_all_uids:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <ind-def:variable_object id="oval:ssg-obj_accounts_umask_etc_profile:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_profile_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:variable_object id="oval:ssg-obj_accounts_umask_etc_login_defs:obj:1" version="1">
                <ind-def:var_ref>oval:ssg-var_etc_login_defs_umask_as_number:var:1</ind-def:var_ref>
              </ind-def:variable_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_passwords_pam_faillock_enforce_local:obj:1" version="1">
                <ind-def:filepath>/etc/security/faillock.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_system_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-pwhistory_line_regex_system_auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_pwhistory_remember_password_auth:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/password-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match" var_ref="oval:ssg-pwhistory_line_regex_password_auth:var:1" var_check="all"/>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_faillock:obj:1" version="1">
                <ind-def:filepath>/etc/pam.d/system-auth</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_faillock\.so.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_root:obj:1" version="1">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*enforce_for_root[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_password_pam_enforce_local:obj:1" version="1">
                <ind-def:filepath>/etc/security/pwquality.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*local_users_only[\s]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_accounts_have_homedir_login_defs:obj:1" version="2">
                <ind-def:filepath>/etc/login.defs</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*(?i)CREATE_HOME(?-i)[\s]+yes[\s]*(?:#.*)?$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_PAE_NX_cpu_support:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags[\s]+:.*[\s]+pae[\s]+.*[\s]+nx[\s]+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_NX_cpu_support:obj:1" version="1">
                <ind-def:filepath>/proc/cpuinfo</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^flags[\s]+:.*[\s]+nx[\s]+.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:password_object id="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" version="1">
                <unix-def:username operation="pattern match">.*</unix-def:username>
              </unix-def:password_object>
              <unix-def:file_object id="oval:ssg-file_permissions_unowned_object:obj:1" version="1" comment="all local files">
                <unix-def:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename operation="pattern match">.*</unix-def:filename>
                <filter>oval:ssg-file_permissions_unowned_userid_list_match:ste:1</filter>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-etc_group_object:obj:1" version="1">
                <ind-def:filepath>/etc/group</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[^:]+:[^:]*:([\d]+):[^:]*$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-dir_object_file_permissions_lib_dir:obj:1" version="1" comment="library directories">
                <unix-def:path operation="pattern match">^\/lib(|64)|^\/usr\/lib(|64)</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-dir_state_perms_nogroupwrite_noworldwrite:ste:1</filter>
                <filter>oval:ssg-dir_perms_state_symlink:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-crypto_policies_current_file:obj:1" version="1" comment="crypto-policies current state">
                <unix-def:filepath>/etc/crypto-policies/state/current</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-crypto_policies_config_file:obj:1" version="1" comment="crypto-policies config state">
                <unix-def:filepath>/etc/crypto-policies/config</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_uid_zero:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_uid_is_not_root_and_world_writable:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_uid:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_uid_is_user_and_world_writable:ste:1</filter>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-all_local_directories_gid:obj:1" version="1" comment="all local directories">
                <unix-def:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local"/>
                <unix-def:path>/</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
                <filter action="include">oval:ssg-state_gid_is_user_and_world_writable:ste:1</filter>
              </unix-def:file_object>
            </objects>
            <states>
              <ind-def:variable_state id="oval:ssg-ste_umask_for_daemons:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-ste_system_crypto_policy_value:ste:1" version="2" comment="variable value is set to 'FIPS' or 'FIPS:modifier', where the modifier corresponds to a crypto policy module that further restricts the modified crypto policy.">
                <ind-def:value operation="pattern match">^FIPS(:(OSPP|NO-SHA1|NO-CAMELLIA))?$</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_start_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int">10</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_rate_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int">30</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_sshd_config_full_parameter_valid:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int">100</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_harden_sshd_macs_openssh_conf_crypto_policy:ste:1" version="1">
                <ind-def:text var_ref="oval:ssg-sshd_macs_crypto:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-ste_harden_sshd_ciphers_openssh_conf_crypto_policy:ste:1" version="1">
                <ind-def:text var_ref="oval:ssg-sshd_ciphers_crypto:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-ste_accounts_umask_etc_profile:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-ste_accounts_umask_etc_login_defs:ste:1" version="1">
                <ind-def:value operation="bitwise and" datatype="int" var_ref="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" var_check="all"/>
              </ind-def:variable_state>
              <unix-def:file_state id="oval:ssg-state_world_writable_and_not_sticky:ste:1" version="1">
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_var_tmp_tmp_inst:ste:1" version="1">
                <unix-def:type>directory</unix-def:type>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <ind-def:variable_state id="oval:ssg-state_var_removable_partition_is_cd_dvd_drive:ste:1" version="1">
                <ind-def:value>/dev/cdrom</ind-def:value>
              </ind-def:variable_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_var_log_audit_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <ind-def:variable_state id="oval:ssg-state_var_faillock_unlock_time_is_never:ste:1" version="1">
                <ind-def:value datatype="int">0</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_upper_bound:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_var_accounts_passwords_pam_faillock_deny_value_lower_bound:ste:1" version="1">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_less_than_zero:ste:1" version="1">
                <ind-def:subexpression operation="less than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_less_than_sys_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="less than" datatype="int" var_ref="oval:ssg-variable_sys_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_uid_is_user_and_world_writable:ste:1" version="1" comment="uid greater than or equal to 1000 and world writable">
                <unix-def:user_id operation="greater than or equal" datatype="int">1000</unix-def:user_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_uid_is_not_root_and_world_writable:ste:1" version="1" comment="uid greater than 0 and world writable">
                <unix-def:user_id operation="greater than" datatype="int">0</unix-def:user_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_min:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_sys_uid_min_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_uid_greater_than_or_equal_sys_uid_max:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-variable_sys_uid_max_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_tmp_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_tmp_inst:ste:1" version="1">
                <unix-def:type>directory</unix-def:type>
                <unix-def:uread datatype="boolean">false</unix-def:uread>
                <unix-def:uwrite datatype="boolean">false</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_timer_running_dnf-automatic:ste:1" version="1" comment="dnf-automatic is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_timeout_value_upper_bound:ste:1" version="1" comment="upper bound of ClientAliveInterval in seconds">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-sshd_idle_timeout_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_timeout_value_lower_bound:ste:1" version="1" comment="lower bound of ClientAliveInterval in seconds">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_time_service_set_maxpoll:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_time_service_set_maxpoll:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_socket_on:ste:1" version="1" comment="usbguard listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">usbguard.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_usbguard_on:ste:1" version="1" comment="usbguard listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">usbguard.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_syslogng_socket_on:ste:1" version="1" comment="syslogng listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">syslogng.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_syslogng_on:ste:1" version="1" comment="syslogng listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">syslogng.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_socket_on:ste:1" version="1" comment="rsyslog listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rsyslog.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rsyslog_on:ste:1" version="1" comment="rsyslog listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rsyslog.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_socket_on:ste:1" version="1" comment="rngd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rngd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_rngd_on:ste:1" version="1" comment="rngd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">rngd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_socket_on:ste:1" version="1" comment="pcscd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">pcscd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_pcscd_on:ste:1" version="1" comment="pcscd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">pcscd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_socket_on:ste:1" version="1" comment="ntpd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntpd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntpd_on:ste:1" version="1" comment="ntpd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntpd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_socket_on:ste:1" version="1" comment="ntp listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntp.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ntp_on:ste:1" version="1" comment="ntp listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ntp.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_socket_on:ste:1" version="1" comment="iptables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">iptables.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_iptables_on:ste:1" version="1" comment="iptables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">iptables.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_socket_on:ste:1" version="1" comment="ip6tables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ip6tables.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_ip6tables_on:ste:1" version="1" comment="ip6tables listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">ip6tables.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_socket_on:ste:1" version="1" comment="firewalld listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">firewalld.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_firewalld_on:ste:1" version="1" comment="firewalld listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">firewalld.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_dnf-automatic_on:ste:1" version="1" comment="dnf-automatic listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">dnf-automatic.timer</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_crond_socket_on:ste:1" version="1" comment="crond listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">crond.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_crond_on:ste:1" version="1" comment="crond listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">crond.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_cron_socket_on:ste:1" version="1" comment="cron listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">cron.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_cron_on:ste:1" version="1" comment="cron listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">cron.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_socket_on:ste:1" version="1" comment="chronyd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">chronyd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_chronyd_on:ste:1" version="1" comment="chronyd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">chronyd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_socket_on:ste:1" version="1" comment="auditd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">auditd.socket</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <lin-def:systemdunitdependency_state id="oval:ssg-state_systemd_auditd_on:ste:1" version="1" comment="auditd listed at least once in the dependencies">
                <lin-def:dependency entity_check="at least one">auditd.service</lin-def:dependency>
              </lin-def:systemdunitdependency_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_x86_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>x86_64</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_x86:ste:1" version="1" comment="32 bit architecture">
                <unix-def:processor_type>i686</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_s390_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>s390x</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64le</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppc_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64</unix-def:processor_type>
              </unix-def:uname_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_aarch_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>aarch64</unix-def:processor_type>
              </unix-def:uname_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_system_auth_pam_unix_rounds:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_system_auth_default_pam_unix_rounds_var:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-var_system_auth_default_hashing_rounds:var:1" var_check="all"/>
              </ind-def:variable_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_vm_mmap_min_addr:ste:1" version="1">
                <unix-def:value datatype="int">65536</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_user_max_user_namespaces:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_max_addresses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_autoconf:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_default_accept_ra:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_max_addresses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_autoconf:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_tcp_syncookies:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_local_port_range:ste:1" version="1">
                <unix-def:value operation="pattern match">32768\s*65535</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_ip_forward:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_send_redirects:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_rp_filter:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_log_martians:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_send_redirects:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_rp_filter:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_log_martians:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
                <unix-def:value datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" var_check="all"/>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_net_core_bpf_jit_harden:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_yama_ptrace_scope:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_unprivileged_bpf_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_sysrq:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_randomize_va_space:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_pid_max:ste:1" version="1">
                <unix-def:value datatype="int">65536</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_paranoid:ste:1" version="1">
                <unix-def:value datatype="int">2</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_event_max_sample_rate:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_perf_cpu_time_max_percent:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_modules_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kptr_restrict:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_kexec_load_disabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_dmesg_restrict:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_kernel_core_pattern:ste:1" version="1">
                <unix-def:value>|/bin/false</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_suid_dumpable:ste:1" version="1">
                <unix-def:value datatype="int">0</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_symlinks:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_runtime_fs_protected_hardlinks:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_kernel_exec_shield:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <unix-def:sysctl_state id="oval:ssg-state_sysctl_crypto_fips_enabled:ste:1" version="1">
                <unix-def:value datatype="int">1</unix-def:value>
              </unix-def:sysctl_state>
              <ind-def:variable_state id="oval:ssg-state_symlink_kerberos_crypto_policy_backend:ste:1" version="1">
                <ind-def:value var_ref="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_router_solicitations:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_max_addresses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_autoconf:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_pinfo:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra_defrtr:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_default_accept_ra:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_router_solicitations:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_max_addresses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_autoconf:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_pinfo:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv6_conf_all_accept_ra_defrtr:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_tcp_syncookies:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_secure_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_rp_filter:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_log_martians:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_source_route:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_default_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_secure_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_rp_filter:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_log_martians:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_source_route:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_static_sysctld_net_ipv4_conf_all_accept_redirects:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_user_value:ste:1" version="1" comment="value of user setting">
                <ind-def:subexpression>sssd</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_ssh_known_hosts_timeout:ste:1" version="1" comment="value of ssh_known_hosts_timeout setting">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_memcache_timeout:ste:1" version="1" comment="value of memcache_timeout setting">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sssd_memcache_timeout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sssd_certificate_verification:ste:1" version="1" comment="value of certificate_verification">
                <ind-def:subexpression var_ref="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_x11_use_localhost:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_use_priv_separation:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sshd_priv_separation:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^VERBOSE$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_verbose:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^VERBOSE$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^INFO$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_loglevel_info:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^INFO$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^0$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_set_keepalive_0:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^0$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_requirement_unset:ste:1" version="1">
                <ind-def:value datatype="int">0</ind-def:value>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_required:ste:1" version="1">
                <ind-def:value datatype="int">2</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_print_last_log:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_sshd_not_required:ste:1" version="1">
                <ind-def:value datatype="int">1</ind-def:value>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_x11_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_warning_banner:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^/etc/issue$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_strictmodes:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_enable_gssapi_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_do_not_permit_user_env:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_x11_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_user_known_hosts:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_tcp_forwarding:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^prohibit-password$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_password_login:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^prohibit-password$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_root_login:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_rhosts:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_pubkey_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_kerb_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_gssapi_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_empty_passwords:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_disable_compression:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sshd_disable_compression:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_sshd_clientalivecountmax:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sshd_set_keepalive:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_srv_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_setuid_or_setgid_set:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
              </unix-def:file_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_usbguard:ste:1" version="1" comment="usbguard is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_syslogng:ste:1" version="1" comment="syslogng is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_rsyslog:ste:1" version="1" comment="rsyslog is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_rngd:ste:1" version="1" comment="rngd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_pcscd:ste:1" version="1" comment="pcscd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ntpd:ste:1" version="1" comment="ntpd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ntp:ste:1" version="1" comment="ntp is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_iptables:ste:1" version="1" comment="iptables is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_ip6tables:ste:1" version="1" comment="ip6tables is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_firewalld:ste:1" version="1" comment="firewalld is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_crond:ste:1" version="1" comment="crond is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_cron:ste:1" version="1" comment="cron is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_chronyd:ste:1" version="1" comment="chronyd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_running_auditd:ste:1" version="1" comment="auditd is running">
                <lin-def:value>active</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_systemd-coredump:ste:1" version="1" comment="systemd-coredump is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_syslog:ste:1" version="1" comment="syslog is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_sssd:ste:1" version="1" comment="sssd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_sshd:ste:1" version="1" comment="sshd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rsyncd:ste:1" version="1" comment="rsyncd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcsvcgssd:ste:1" version="1" comment="rpcsvcgssd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcidmapd:ste:1" version="1" comment="rpcidmapd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_rpcgssd:ste:1" version="1" comment="rpcgssd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfslock:ste:1" version="1" comment="nfslock is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_nfs-server:ste:1" version="1" comment="nfs-server is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_netfs:ste:1" version="1" comment="netfs is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_debug-shell:ste:1" version="1" comment="debug-shell is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_bluetooth:ste:1" version="1" comment="bluetooth is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_autofs:ste:1" version="1" comment="autofs is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_not_running_atd:ste:1" version="1" comment="atd is not running">
                <lin-def:value>inactive</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_systemd-coredump:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_syslog:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_sshd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rsyncd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcsvcgssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcidmapd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_rpcgssd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfslock:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_nfs-server:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_netfs:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_debug-shell:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_bluetooth:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_autofs:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <lin-def:systemdunitproperty_state id="oval:ssg-state_service_loadstate_is_masked_atd:ste:1" version="1" comment="LoadState is set to masked">
                <lin-def:value>masked</lin-def:value>
              </lin-def:systemdunitproperty_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_server_has_maxpoll:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">maxpoll \d+</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_selinux_policy:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_selinux_policy_name:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_unlabeled_t:ste:1" version="1" comment="unlabeled_t label">
                <lin-def:type>unlabeled_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_dev_device_t:ste:1" version="1" comment="device_t label">
                <lin-def:type>device_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <lin-def:selinuxsecuritycontext_state id="oval:ssg-state_selinux_confinement_of_daemons:ste:1" version="1" comment="state unconfined_service_t">
                <lin-def:type>unconfined_service_t</lin-def:type>
              </lin-def:selinuxsecuritycontext_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_screensaver_lock_delay_setting:ste:1" version="1">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-var_screensaver_lock_delay:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_screensaver_idle_delay_setting:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-inactivity_timeout_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rsyslog_remote_tls:ste:1" version="1" comment="value of omfwd action">
                <ind-def:subexpression operation="pattern match">(?=[\S\s]*\s(?i)protocol(?-i)="tcp")(?=[\S\s]*\s(?i)Target(?-i)="[^"]+?")(?=[\S\s]*\s(?i)port(?-i)="6514")(?=[\S\s]*\s(?i)StreamDriver(?-i)="gtls")(?=[\S\s]*\s(?i)StreamDriverMode(?-i)="1")(?=[\S\s]*\s(?i)StreamDriverAuthMode(?-i)="x509/name")(?=[\S\s]*\s(?i)StreamDriver\.CheckExtendedKeyPurpose(?-i)="on")</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_permissions:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_root_mail_alias:ste:1" version="1" comment="root email alias">
                <ind-def:subexpression var_ref="oval:ssg-var_postfix_root_mail_alias:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:4.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhosp13_release:ste:1" version="1">
                <lin-def:version operation="pattern match">^13.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhosp10_release:ste:1" version="1">
                <lin-def:version operation="pattern match">^10.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
                <lin-def:version operation="pattern match">^4.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.9*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.8*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.7*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.6*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.5*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.4*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.3*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.2*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.1*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.10*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.0*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">rhcos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">4</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proper_audit_rule_but_for_unprivileged_command:ste:1" version="1">
                <ind-def:subexpression operation="not equal" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:interface_state id="oval:ssg-state_promisc:ste:1" version="1">
                <unix-def:flag entity_check="at least one">PROMISC</unix-def:flag>
              </unix-def:interface_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^s390x$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_64_bit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(x86_64|aarch64|ppc64le|s390x)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_cpuinfo_64_bit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">\blm\b</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_perms_binary_files_symlink:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_perms_binary_files_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_permissions_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_ucredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_ucredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_retry_upper_bound:ste:1" version="1" comment="upper bound of password_pam_retry">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_retry:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_retry_lower_bound:ste:1" version="1" comment="lower bound of password_pam_retry">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_ocredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_ocredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_minlen:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_minlen:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_minclass:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_minclass:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_maxrepeat:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_maxrepeat:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_maxclassrepeat:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_maxclassrepeat:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_lcredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_lcredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_difok:ste:1" version="3">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_difok:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_dictcheck:ste:1" version="3">
                <ind-def:subexpression datatype="int" var_ref="oval:ssg-var_password_pam_dictcheck:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_pam_dcredit:ste:1" version="3">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_dcredit:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_password_auth_pam_unix_rounds:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_rounds:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_password_auth_default_pam_unix_rounds_var:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-var_password_auth_default_hashing_rounds:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_pam_pkcs11_cert_policy_ocsp_on:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*ocsp_on.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9867c58f-601c49ca:ste:1" version="1">
                <lin-def:release>601c49ca</lin-def:release>
                <lin-def:version>9867c58f</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-9570ff31-5e3006fb:ste:1" version="1">
                <lin-def:release>5e3006fb</lin-def:release>
                <lin-def:version>9570ff31</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_package_gpg-pubkey-45719a39-5f2c0192:ste:1" version="1">
                <lin-def:release>5f2c0192</lin-def:release>
                <lin-def:version>45719a39</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_owner_systemmap:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_not_root_var_log_audit-non_root:ste:1" version="1" operator="OR">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_not_root_root_var_log_audit:ste:1" version="1" operator="OR">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_library_dirs_not_root:ste:1" version="1">
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_owner_libraries_not_root:ste:1" version="1">
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_owner_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_owner_binaries_not_root:ste:1" version="1" operator="OR">
                <unix-def:user_id operation="not equal" datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <lin-def:partition_state id="oval:ssg-state_opt_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^42.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
                <lin-def:name operation="pattern match">openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_openssh-server_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:7.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0750:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0700:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0640:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_not_mode_0600:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nosuid,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nosuid_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nosuid,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?noexec,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_noexec_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?noexec,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_not_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nodev,?.*</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_nodev_etc_fstab_cd_dvd_drive:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*,?nodev,?.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_no_duplicate_uids:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_uids:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_network_nmcli_permissions:ste:1" version="1">
                <ind-def:subexpression>ResultActive=auth_admin</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_mount_option_var_tmp_bind_compare_source:ste:1" version="1">
                <lin-def:device var_ref="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" var_check="all" entity_check="at least one"/>
              </lin-def:partition_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxsessions_value_upper_bound:ste:1" version="1" comment="upper bound of MaxSessions in number of sessions">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_sshd_max_sessions:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxsessions_value_lower_bound:ste:1" version="1" comment="lower bound of MaxSessions in number of sessions">
                <ind-def:subexpression operation="greater than or equal" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxlogins:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_upper_bound:ste:1" version="1" comment="upper bound of MaxAuthTries">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-sshd_max_auth_tries_value:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_maxauthtries_value_lower_bound:ste:1" version="1" comment="lower bound of MaxAuthTries">
                <ind-def:subexpression operation="greater than" datatype="int">0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_logfile_sudoers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_sudo_logfile:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_location_of_kerberos_crypto_policy_backend:ste:1" version="1">
                <ind-def:value>/etc/crypto-policies/back-ends/krb5.config</ind-def:value>
              </ind-def:variable_state>
              <lin-def:partition_state id="oval:ssg-state_local_nodev:ste:1" version="1">
                <lin-def:device operation="pattern match">^/dev/.*$</lin-def:device>
                <lin-def:mount_options operation="not equal">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <ind-def:variable_state id="oval:ssg-state_local_db_is_up_to_date:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_warn_age_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_min_len_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_password_minlen_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_min_days_instance_value:ste:1" version="1">
                <ind-def:value operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_minimum_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_pass_max_days_instance_value:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_maximum_age_login_defs:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_last_encrypt_method_instance_value:ste:1" version="1">
                <ind-def:value var_ref="oval:ssg-var_password_hashing_algorithm:var:1" var_check="all"/>
              </ind-def:variable_state>
              <lin-def:partition_state id="oval:ssg-state_home_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_home_dirs_wrong_perm:ste:1" version="1" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_home_dirs_home_itself:ste:1" version="1">
                <unix-def:path>/home</unix-def:path>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_sshd_crypto_policy:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^'-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_RekeyLimit:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^512M 1h$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Match:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^final all$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_MACs:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^hmac-sha2-512,hmac-sha2-256$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_KexAlgorithms:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_GSSAPIAuthentication:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_harden_ssh_client_crypto_policy_Ciphers:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^aes256-ctr,aes256-cbc,aes128-ctr,aes128-cbc$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_vsyscall_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?vsyscall=none(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_slub_debug_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?slub_debug=P(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_pti_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?pti=on(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_page_poison_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?page_poison=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_nousb_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^.*\bnousb\b.*$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_ipv6_disable_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?ipv6\.disable=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_iommu_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?iommu=force(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_audit_backlog_limit_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?audit_backlog_limit=8192(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_grub2_audit_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?audit=1(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_groupownership_ignore_include_paths:ste:1" version="1" comment="ignore">
                <ind-def:text operation="pattern match">(?:file="[^\s;]+"|\$IncludeConfig[\s]+[^\s;]+|\/dev\/.*)</ind-def:text>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_groupowner_system_commands_dirs_not_root:ste:1" version="1">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_group_owner_library_dirs_not_root:ste:1" version="1">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gnome_gdm_disable_xdmcp:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^false$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gid_passwd_group_same:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_gid_passwd_group_same:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_gid_is_user_and_world_writable:ste:1" version="1" comment="gid greater than or equal to 1000 and world writable">
                <unix-def:group_id operation="greater than or equal" datatype="int">1000</unix-def:group_id>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_gdm_login_banner_text_setting:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_force_opensc_card_drivers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_smartcard_drivers:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <lin-def:rpmverifyfile_state id="oval:ssg-state_files_fail_mode:ste:1" version="1">
                <lin-def:mode_differs>fail</lin-def:mode_differs>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:ssg-state_files_fail_md5_hash:ste:1" version="1">
                <lin-def:md5_differs>fail</lin-def:md5_differs>
                <lin-def:configuration_file datatype="boolean">false</lin-def:configuration_file>
                <lin-def:ghost_file datatype="boolean">false</lin-def:ghost_file>
              </lin-def:rpmverifyfile_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_var_log_mode_not_0755:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_var_log_messages_mode_not_0640:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_ungroupowned:ste:1" version="1" comment="Files that are owned by a group.">
                <unix-def:group_id datatype="int" var_ref="oval:ssg-variable_file_permissions_ungroupowned:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_sys:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/sys/.*$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_special_selinux_files:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/selinux/(?:(?:member)|(?:user)|(?:relabel)|(?:create)|(?:access)|(?:context))$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write_exclude_proc:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^/proc/.*$</unix-def:filepath>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_world_write:ste:1" version="1">
                <unix-def:type>regular</unix-def:type>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_suid_set:ste:1" version="1">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_suid_filepaths:ste:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_sgid_set:ste:1" version="1">
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_unauthorized_sgid_filepaths:ste:1" version="1">
                <unix-def:filepath var_ref="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_systemmap:ste:1" version="1">
                <unix-def:suid datatype="boolean">false</unix-def:suid>
                <unix-def:sgid datatype="boolean">false</unix-def:sgid>
                <unix-def:sticky datatype="boolean">false</unix-def:sticky>
                <unix-def:uexec datatype="boolean">false</unix-def:uexec>
                <unix-def:gread datatype="boolean">false</unix-def:gread>
                <unix-def:gwrite datatype="boolean">false</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">false</unix-def:gexec>
                <unix-def:oread datatype="boolean">false</unix-def:oread>
                <unix-def:owrite datatype="boolean">false</unix-def:owrite>
                <unix-def:oexec datatype="boolean">false</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_sshd_pub_key_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_sshd_private_key_mode_not_0640:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_grub2_cfg_mode_not_0600:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_shadow_mode_not_0000:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uread datatype="boolean">true</unix-def:uread>
                <unix-def:uwrite datatype="boolean">true</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_passwd_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_motd_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_issue_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_gshadow_mode_not_0000:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uread datatype="boolean">true</unix-def:uread>
                <unix-def:uwrite datatype="boolean">true</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_group_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_audit_rulesd_mode_not_0640:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_etc_audit_auditd_mode_not_0640:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_efi_grub2_cfg_mode_not_0700:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_shadow_mode_not_0000:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uread datatype="boolean">true</unix-def:uread>
                <unix-def:uwrite datatype="boolean">true</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_passwd_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_gshadow_mode_not_0000:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uread datatype="boolean">true</unix-def:uread>
                <unix-def:uwrite datatype="boolean">true</unix-def:uwrite>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gread datatype="boolean">true</unix-def:gread>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:oread datatype="boolean">true</unix-def:oread>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_permissions_backup_etc_group_mode_not_0644:ste:1" version="2" operator="OR">
                <unix-def:suid datatype="boolean">true</unix-def:suid>
                <unix-def:sgid datatype="boolean">true</unix-def:sgid>
                <unix-def:sticky datatype="boolean">true</unix-def:sticky>
                <unix-def:uexec datatype="boolean">true</unix-def:uexec>
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:gexec datatype="boolean">true</unix-def:gexec>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
                <unix-def:oexec datatype="boolean">true</unix-def:oexec>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_var_log_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_var_log_messages_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_motd_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_issue_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_etc_group_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_efi_grub2_cfg_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_shadow_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_passwd_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_gshadow_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_owner_backup_etc_group_uid_0:ste:1" version="1">
                <unix-def:user_id datatype="int">0</unix-def:user_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_var_log_messages_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_var_log_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_grub2_cfg_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_shadow_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_passwd_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_motd_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_issue_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_gshadow_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_etc_group_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_efi_grub2_cfg_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_file_groupowner_backup_etc_group_gid_0:ste:1" version="1">
                <unix-def:group_id datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_selinux_config:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_selinux_state:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_profile_tmout:ste:1" version="2">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_accounts_tmout:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_etc_passwd_no_duplicate_user_names:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive_nonnegative:ste:1" version="1">
                <ind-def:subexpression operation="greater than" datatype="int">-1</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_etc_default_useradd_inactive:ste:1" version="1">
                <ind-def:subexpression operation="less than or equal" datatype="int" var_ref="oval:ssg-var_account_disable_post_pw_expiration:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_ends_colon_period:ste:1" version="1" comment="ends with colon or period">
                <ind-def:value operation="pattern match">[:\.]$</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_enable_dracut_fips_module:ste:1" version="1">
                <ind-def:subexpression>fips</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dnf-automatic_security_updates_only:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^security$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dnf-automatic_apply_updates:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^yes$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:symlink_state id="oval:ssg-state_disable_xwindows_runlevel_target:ste:1" version="1" comment="default.target is linked to multi-user.target">
                <unix-def:filepath>/etc/systemd/system/default.target</unix-def:filepath>
                <unix-def:canonical_path operation="pattern match">^(/usr)?/lib/systemd/system/multi-user.target$</unix-def:canonical_path>
              </unix-def:symlink_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_disable_host_auth_config_dir:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_disable_host_auth:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^no$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:symlink_state id="oval:ssg-state_disable_ctrlaltdel_exists:ste:1" version="1" comment="Disable Ctrl-Alt-Del key sequence override exists">
                <unix-def:filepath>/etc/systemd/system/ctrl-alt-del.target</unix-def:filepath>
                <unix-def:canonical_path>/dev/null</unix-def:canonical_path>
              </unix-def:symlink_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_nosuid_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_noexec_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_dev_shm_partition_nodev_optional_no:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_dev_proc_sys_dirs:ste:1" version="1">
                <unix-def:filepath operation="pattern match">^\/(dev|proc|sys)\/.*$</unix-def:filepath>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_default_os_user:ste:1" version="1" comment="The user root is always allowed as default opering system user">
                <ind-def:subexpression operation="pattern match">^root$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dconf_gnome_lock_screen_on_smartcard_removal:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^'lock-screen'$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_dconf_gnome_disable_user_admin:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^true$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:variable_state id="oval:ssg-state_crypto_current_file_newer_than_config_file:ste:1" version="1">
                <ind-def:value operation="less than or equal" datatype="int" var_ref="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" var_check="all"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_augenrules:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:variable_state id="oval:ssg-state_count_of_privileged_commands_having_audit_definition_auditctl:ste:1" version="1">
                <ind-def:value datatype="int" var_ref="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" var_check="at least one"/>
              </ind-def:variable_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?:.*\s)?selinux=0(?:\s.*)?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coredump_disable_storage:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)none(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_coredump_disable_backtraces:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)0(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_core_dumps_limitsconf:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_core_dumps_limits_d:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_relative_path:ste:1" version="1" comment="elements begin with a slash">
                <ind-def:value operation="pattern match">[^\\]:[^/]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_double_period:ste:1" version="1" comment="period twice in a row">
                <ind-def:value operation="pattern match">\.\.</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_contains_double_colon:ste:1" version="1" comment="colon twice in a row">
                <ind-def:value operation="pattern match">::</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_usbguard_auditbackend:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^LinuxAudit$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_opensc_card_drivers:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_smartcard_drivers:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy_current:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_system_crypto_policy:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_crypto_policy:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_system_crypto_policy:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_configure_bashrc_exec_tmux:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">if \[ "\$PS1" \]; then\n\s+parent=\$\(ps -o ppid= -p \$\$\)\n\s+name=\$\(ps -o comm= -p \$parent\)\n\s+case "\$name" in sshd\|login\) exec tmux ;; esac\nfi</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_run_as_chrony_user:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^["]?.*-u chrony.*["]?$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_port_value_0:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_chronyd_cmdport_value_0:ste:1" version="1">
                <ind-def:subexpression>0</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_bootloader_disable_recovery_argument:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^true|"true"$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_nosuid_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_noexec_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_nodev_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
              </lin-def:partition_state>
              <lin-def:partition_state id="oval:ssg-state_boot_partition_noauto_optional_yes:ste:1" version="1">
                <lin-def:mount_options entity_check="at least one">noauto</lin-def:mount_options>
              </lin-def:partition_state>
              <unix-def:file_state id="oval:ssg-state_block_or_char_device_file:ste:1" version="1" comment="device files">
                <unix-def:type operation="pattern match">^(block|character) special$</unix-def:type>
              </unix-def:file_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_begins_slash:ste:1" version="1" comment="begins with a slash">
                <ind-def:value operation="pattern match">^[^/]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:environmentvariable58_state id="oval:ssg-state_begins_colon_period:ste:1" version="1" comment="starts with colon or period">
                <ind-def:value operation="pattern match">^[:\.]</ind-def:value>
              </ind-def:environmentvariable58_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_banner_etc_motd:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_banner_etc_issue:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-login_banner_text:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_write_logs:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)yes(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_overflow_action:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)(syslog|single|halt)(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_name_format:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)hostname(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_log_format:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)ENRICHED(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_local_events:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)yes(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_freq:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^(?i)50(?-i)$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_percentage:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_space_left_percentage:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_space_left_action:ste:1" version="2">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_space_left_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_num_logs:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_num_logs:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_max_log_file_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_max_log_file:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_auditd_max_log_file:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_flush:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_flush:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_admin_space_left_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_admin_space_left_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_retention_action_mail_acct:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_auditd_action_mail_acct:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_full_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_full_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_data_disk_error_action:ste:1" version="1">
                <ind-def:subexpression operation="case insensitive equals" var_ref="oval:ssg-var_auditd_disk_error_action:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_auditd_audispd_configure_remote_server:ste:1" version="1">
                <ind-def:subexpression var_ref="oval:ssg-var_audispd_remote_server:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_audit_rules_privileged_commands:ste:1" version="1">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-variable_all_privileged_commands:var:1" var_check="at least one"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_aide_check_attributes:ste:1" version="1">
                <ind-def:subexpression>p+i+n+u+g+s+b+acl+selinux+xattrs+sha512</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1" version="1" operator="OR" comment="group or other has write privilege">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-state_accounts_root_path_dirs_symlink:ste:1" version="1" comment="symbolic link">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_unlock_time_is_never:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^0$|^never$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_unlock_time_greater_or_equal_than_ext_var:ste:1" version="2">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_system-auth:ste:1" version="2">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_passwords_pam_faillock_fail_interval_password-auth:ste:1" version="2">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_unix_remember:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_unix_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_system_auth:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_password_pam_pwhistory_remember_password_auth:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_password_pam_remember:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_sha512:ste:1" version="1">
                <unix-def:encrypt_method>SHA-512</unix-def:encrypt_method>
              </unix-def:shadow_state>
              <unix-def:shadow_state id="oval:ssg-state_accounts_password_all_shadowed_has_no_password:ste:1" version="1">
                <unix-def:password operation="pattern match">^(!|!!|\*)$</unix-def:password>
              </unix-def:shadow_state>
              <unix-def:password_state id="oval:ssg-state_accounts_password_all_shadowed:ste:1" version="1">
                <unix-def:password operation="pattern match">x|\*</unix-def:password>
              </unix-def:password_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_logon_fail_delay:ste:1" version="1">
                <ind-def:subexpression operation="greater than or equal" datatype="int" var_ref="oval:ssg-var_accounts_fail_delay:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_accounts_authorized_local_users:ste:1" version="1" comment="authorized usernames required by the installed software groups and applications">
                <ind-def:subexpression operation="pattern match" var_ref="oval:ssg-var_accounts_authorized_local_users_regex:var:1" var_check="all"/>
              </ind-def:textfilecontent54_state>
              <unix-def:file_state id="oval:ssg-perms_state_symlink:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-group_permissions_for_system_wide_files_are_not_root:ste:1" version="1">
                <unix-def:group_id operation="not equal" datatype="int">0</unix-def:group_id>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-file_permissions_unowned_userid_list_match:ste:1" version="1">
                <unix-def:user_id datatype="int" var_ref="oval:ssg-file_permissions_unowned_userid_list:var:1" var_check="at least one"/>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-dir_state_perms_nogroupwrite_noworldwrite:ste:1" version="1" operator="OR">
                <unix-def:gwrite datatype="boolean">true</unix-def:gwrite>
                <unix-def:owrite datatype="boolean">true</unix-def:owrite>
              </unix-def:file_state>
              <unix-def:file_state id="oval:ssg-dir_perms_state_symlink:ste:1" version="1">
                <unix-def:type>symbolic link</unix-def:type>
              </unix-def:file_state>
            </states>
            <variables>
              <local_variable id="oval:ssg-variable_uid_min_value:var:1" version="1" datatype="int" comment="Value of last UID_MIN from /etc/login.defs">
                <regex_capture pattern="UID_MIN[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_uid_min_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_sys_uid_min_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MIN from /etc/login.defs">
                <regex_capture pattern="SYS_UID_MIN[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_sys_uid_min_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_sys_uid_max_value:var:1" version="1" datatype="int" comment="Value of last SYS_UID_MAX from /etc/login.defs">
                <regex_capture pattern="SYS_UID_MAX[\s]+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_sys_uid_max_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_required_system_auth:var:1" version="1" datatype="string" comment="Regular expressiion to check if smartcard authentication is required in /etc/pam.d/system-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
                  <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
                  <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_required_smartcard_auth:var:1" version="1" datatype="string" comment="Regular expression to check if smartcard authentication is required in /etc/pam.d/smartcard-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug[\s]wait_for_card\n.*</literal_component>
                  <literal_component>\npassword[\s]+required[\s]+pam_pkcs11.so\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_smart_card_enabled_system_auth:var:1" version="1" datatype="string" comment="Regular expression to check if smartcard authentication is enabled in /etc/pam.d/system-auth">
                <concat>
                  <literal_component>\nauth[\s]+required[\s]+pam_env.so</literal_component>
                  <literal_component>\nauth[\s]+\[success=1[\s]default=ignore\][\s]pam_succeed_if.so[\s]service[\s]notin[\s]</literal_component>
                  <literal_component>login:gdm:xdm:kdm:xscreensaver:gnome-screensaver:kscreensaver[\s]quiet[\s]use_uid</literal_component>
                  <literal_component>\nauth[\s]+\[success=done[\s]authinfo_unavail=ignore[\s]ignore=ignore[\s]default=die\][\s]</literal_component>
                  <literal_component>pam_pkcs11.so[\s]nodebug\n</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_not_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for removable block special device other than CD / DVD drive">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-var_removable_partition:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_warn_age_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_WARN_AGE directive in /etc/login.defs">
                <regex_capture pattern="PASS_WARN_AGE\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_warn_age_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_min_len_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs">
                <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_min_len_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_min_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MIN_DAYS directive in /etc/login.defs">
                <regex_capture pattern="PASS_MIN_DAYS\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_min_days_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_pass_max_days_instance_value:var:1" version="1" datatype="int" comment="The value of last PASS_MAX_DAYS directive in /etc/login.defs">
                <regex_capture pattern="PASS_MAX_DAYS\s+(\d+)">
                  <object_component object_ref="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_last_encrypt_method_instance_value:var:1" version="1" datatype="string" comment="The value of last ENCRYPT_METHOD directive in /etc/login.defs">
                <regex_capture pattern="ENCRYPT_METHOD\s+(\w+)">
                  <object_component object_ref="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </regex_capture>
              </local_variable>
              <local_variable id="oval:ssg-variable_file_permissions_ungroupowned:var:1" version="1" datatype="int" comment="all GIDs on the target system">
                <object_component object_ref="oval:ssg-etc_group_object:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_dev_device_files:var:1" version="1" datatype="string" comment="all device files within /dev directory">
                <object_component object_ref="oval:ssg-object_dev_device_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/state/current">
                <object_component object_ref="oval:ssg-crypto_policies_current_file:obj:1" item_field="m_time"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1" version="1" datatype="int" comment="Age of /etc/crypto-policies/config">
                <object_component object_ref="oval:ssg-crypto_policies_config_file:obj:1" item_field="m_time"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of unique username rows retrieved from /etc/passwd">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-object_etc_passwd_content:obj:1" item_field="subexpression"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_unique_uids:var:1" version="1" datatype="int" comment="Count of unique uids">
                <count>
                  <unique>
                    <object_component object_ref="oval:ssg-obj_all_uids:obj:1" item_field="user_id"/>
                  </unique>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_suid_sgid_binaries_on_system:var:1" version="1" datatype="int" comment="count of suid / sgid binaries actually present on the system">
                <count>
                  <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_augenrules:var:1" version="1" datatype="int" comment="count of suid / sgid binaries having full audit rule definition in some of /etc/audit/rules.d/*.rules files">
                <count>
                  <object_component object_ref="oval:ssg-object_arpc_suid_sgid_augenrules:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_privileged_commands_having_audit_definition_auditctl:var:1" version="1" datatype="int" comment="count of suid / sgid binaries having full audit rule definition in /etc/audit/audit.rules file">
                <count>
                  <object_component object_ref="oval:ssg-object_arpc_suid_sgid_auditctl:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1" version="1" datatype="int" comment="Count of all username rows retrieved from /etc/passwd (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-object_etc_passwd_content:obj:1" item_field="subexpression"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_count_of_all_uids:var:1" version="1" datatype="int" comment="Count of all uids (including duplicates if any)">
                <count>
                  <object_component object_ref="oval:ssg-obj_all_uids:obj:1" item_field="user_id"/>
                </count>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nosuid:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_noexec:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_cd_dvd_drive_regex_pattern_nodev:var:1" version="1" datatype="string" comment="Regular expression pattern for CD / DVD drive alternative names">
                <concat>
                  <literal_component>^[\s]*</literal_component>
                  <variable_component var_ref="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1"/>
                  <literal_component>[\s]+[/\w]+[\s]+[\w]+[\s]+([^\s]+)(?:[\s]+[\d]+){2}$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nosuid:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_noexec:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names_nodev:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <constant_variable id="oval:ssg-variable_cd_dvd_drive_alternative_names:var:1" version="1" datatype="string" comment="CD/DVD drive alternative names whitelist">
                <value>/dev/cdrom</value>
                <value>/dev/dvd</value>
                <value>/dev/scd0</value>
                <value>/dev/sr0</value>
              </constant_variable>
              <local_variable id="oval:ssg-variable_all_privileged_commands:var:1" version="1" datatype="string" comment="All privileged commands">
                <object_component object_ref="oval:ssg-object_system_privileged_commands:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-variable_aide_operational_database_absolute_path:var:1" version="1" datatype="string" comment="Absolute path of Aide build database file">
                <concat>
                  <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
                  <literal_component>/</literal_component>
                  <object_component object_ref="oval:ssg-object_aide_operational_database_filename:obj:1" item_field="subexpression"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-variable_aide_build_new_database_absolute_path:var:1" version="1" datatype="string" comment="Absolute path of Aide build database file">
                <concat>
                  <object_component object_ref="oval:ssg-object_aide_build_database_dirpath:obj:1" item_field="subexpression"/>
                  <literal_component>/</literal_component>
                  <object_component object_ref="oval:ssg-object_aide_build_new_database_filename:obj:1" item_field="subexpression"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_umask_for_daemons_umask_as_number:var:1" version="1" datatype="int" comment="var_umask_for_daemons umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1"/>
                </arithmetic>
              </local_variable>
              <external_variable id="oval:ssg-var_umask_for_daemons:var:1" version="1" datatype="string" comment="Value of var_umask_for_daemons (the required umask) as string"/>
              <external_variable id="oval:ssg-var_time_service_set_maxpoll:var:1" version="1" datatype="int" comment="maxpoll value"/>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="Third octal digit of umask from var_umask_for_daemons">
                <substring substring_start="3" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Third octal digit of umask from var_accounts_user_umask">
                <substring substring_start="3" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/profile">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/login.defs">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="Third octal digit of umask from /etc/init.d/functions">
                <substring substring_start="3" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <external_variable id="oval:ssg-var_system_crypto_policy:var:1" version="1" datatype="string" comment="defined crypto policy"/>
              <local_variable id="oval:ssg-var_system_auth_default_hashing_rounds:var:1" version="1" datatype="int" comment="Default number of password hashing rounds">
                <literal_component>5000</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
                <object_component object_ref="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" item_field="canonical_path"/>
              </local_variable>
              <local_variable id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1" version="1" datatype="string" comment="regex variable for canonical path to targeted kerberos policy">
                <object_component object_ref="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" item_field="canonical_path"/>
              </local_variable>
              <external_variable id="oval:ssg-var_sudo_logfile:var:1" version="1" datatype="string" comment="Variable value for sudo logfile "/>
              <external_variable id="oval:ssg-var_sssd_ssh_known_hosts_timeout:var:1" version="1" datatype="int" comment="var_sssd_ssh_known_hosts_timeout value"/>
              <external_variable id="oval:ssg-var_sssd_memcache_timeout:var:1" version="1" datatype="int" comment="memcache_timeout value"/>
              <external_variable id="oval:ssg-var_sssd_certificate_verification_digest_function:var:1" version="1" datatype="string" comment="certificate_verification value"/>
              <external_variable id="oval:ssg-var_sshd_set_keepalive:var:1" version="1" datatype="int" comment="ClientAliveCountMax value"/>
              <external_variable id="oval:ssg-var_sshd_priv_separation:var:1" version="1" datatype="string" comment="external variable for the desired value of UsePrivilegeSeparation"/>
              <external_variable id="oval:ssg-var_sshd_max_sessions:var:1" version="1" datatype="int" comment="maxsessions value"/>
              <external_variable id="oval:ssg-var_sshd_disable_compression:var:1" version="1" datatype="string" comment="external variable for the desired value of Compression"/>
              <external_variable id="oval:ssg-var_smartcard_drivers:var:1" version="1" datatype="string" comment="external variable for opensc smartcard drivers"/>
              <external_variable id="oval:ssg-var_selinux_state:var:1" version="1" datatype="string" comment="external variable for selinux state"/>
              <external_variable id="oval:ssg-var_selinux_policy_name:var:1" version="1" datatype="string" comment="External variable: name of selinux policy in /etc/selinux/config"/>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="Second octal digit of umask from var_umask_for_daemons">
                <substring substring_start="2" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="Second octal digit of umask from var_accounts_user_umask">
                <substring substring_start="2" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/profile">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/login.defs">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="Second octal digit of umask from /etc/init.d/functions">
                <substring substring_start="2" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <external_variable id="oval:ssg-var_screensaver_lock_delay:var:1" version="1" datatype="int" comment="screensaver lock delay variable"/>
              <local_variable id="oval:ssg-var_rfp_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfp_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfp_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfp_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfp_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfo_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfo_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfo_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfo_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_syslog_config:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <literal_component>^/etc/rsyslog.conf$</literal_component>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_log_files_paths:var:1" version="1" datatype="string" comment="File paths of all rsyslog configuration files">
                <object_component object_ref="oval:ssg-object_rfg_log_files_paths:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_include_config_regex:var:1" version="1" datatype="string" comment="$IncludeConfig value converted to regex">
                <unique>
                  <glob_to_regex glob_noescape="false">
                    <object_component object_ref="oval:ssg-object_rfg_rsyslog_include_config_value:obj:1" item_field="subexpression"/>
                  </glob_to_regex>
                </unique>
              </local_variable>
              <local_variable id="oval:ssg-var_rfg_all_log_files:var:1" version="1" datatype="string" comment="Locations of all rsyslog configuration files as collection">
                <object_component object_ref="oval:ssg-object_var_rfg_all_log_files:obj:1" item_field="value"/>
              </local_variable>
              <external_variable id="oval:ssg-var_removable_partition:var:1" version="1" datatype="string" comment="removable partition"/>
              <external_variable id="oval:ssg-var_rekey_limit_time:var:1" version="1" datatype="string" comment="Time component of the rekey limit"/>
              <external_variable id="oval:ssg-var_rekey_limit_size:var:1" version="1" datatype="string" comment="Size component of the rekey limit"/>
              <external_variable id="oval:ssg-var_postfix_root_mail_alias:var:1" version="1" datatype="string" comment="expected email alias"/>
              <external_variable id="oval:ssg-var_password_pam_unix_rounds:var:1" version="1" datatype="int" comment="number of passwords hashing rounds"/>
              <external_variable id="oval:ssg-var_password_pam_unix_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
              <external_variable id="oval:ssg-var_password_pam_ucredit:var:1" version="3" datatype="int" comment="External variable for pam_ucredit"/>
              <external_variable id="oval:ssg-var_password_pam_retry:var:1" version="1" datatype="int" comment="External variable for pam_pwquality retry"/>
              <external_variable id="oval:ssg-var_password_pam_remember_control_flag:var:1" version="1" datatype="string" comment="control flag for pwhistory module"/>
              <external_variable id="oval:ssg-var_password_pam_remember:var:1" version="1" datatype="int" comment="number of passwords that should be remembered"/>
              <external_variable id="oval:ssg-var_password_pam_ocredit:var:1" version="3" datatype="int" comment="External variable for pam_ocredit"/>
              <external_variable id="oval:ssg-var_password_pam_minlen:var:1" version="3" datatype="int" comment="External variable for pam_minlen"/>
              <external_variable id="oval:ssg-var_password_pam_minclass:var:1" version="3" datatype="int" comment="External variable for pam_minclass"/>
              <external_variable id="oval:ssg-var_password_pam_maxrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxrepeat"/>
              <external_variable id="oval:ssg-var_password_pam_maxclassrepeat:var:1" version="3" datatype="int" comment="External variable for pam_maxclassrepeat"/>
              <external_variable id="oval:ssg-var_password_pam_lcredit:var:1" version="3" datatype="int" comment="External variable for pam_lcredit"/>
              <external_variable id="oval:ssg-var_password_pam_difok:var:1" version="3" datatype="int" comment="External variable for pam_difok"/>
              <external_variable id="oval:ssg-var_password_pam_dictcheck:var:1" version="3" datatype="int" comment="External variable for pam_dictcheck"/>
              <external_variable id="oval:ssg-var_password_pam_dcredit:var:1" version="3" datatype="int" comment="External variable for pam_dcredit"/>
              <external_variable id="oval:ssg-var_password_hashing_algorithm:var:1" version="1" datatype="string" comment="defined hashing algorithm"/>
              <local_variable id="oval:ssg-var_password_auth_default_hashing_rounds:var:1" version="1" datatype="int" comment="Default number of password hashing rounds">
                <literal_component>5000</literal_component>
              </local_variable>
              <constant_variable id="oval:ssg-var_pam_pwquality_config_path:var:1" version="1" datatype="string" comment="correct path for pam_pwquality.so check">
                <value>/etc/pam.d/system-auth</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_mount_option_var_tmp_bind_var_tmp_source_device:var:1" version="1" datatype="string" comment="Source device of /var/tmp">
                <object_component object_ref="oval:ssg-object_mount_option_var_tmp:obj:1" item_field="device"/>
              </local_variable>
              <local_variable id="oval:ssg-var_gid_passwd_group_same:var:1" version="1" datatype="string" comment="GIDs from /etc/group">
                <object_component object_ref="oval:ssg-object_gid_passwd_group_same_var:obj:1" item_field="subexpression"/>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_umask_for_daemons:var:1" version="1" datatype="int" comment="First octal digit of umask from var_umask_for_daemons">
                <substring substring_start="1" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_umask_for_daemons:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1" version="1" datatype="int" comment="First octal digit of umask from var_accounts_user_umask">
                <substring substring_start="1" substring_length="1">
                  <variable_component var_ref="oval:ssg-var_accounts_user_umask:var:1"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/profile">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_profile:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/login.defs">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_login_defs:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1" version="1" datatype="int" comment="First octal digit of umask from /etc/init.d/functions">
                <substring substring_start="1" substring_length="1">
                  <object_component object_ref="oval:ssg-obj_umask_from_etc_init_d_functions:obj:1" item_field="subexpression"/>
                </substring>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_rpms:var:1" version="1" datatype="string" comment="all files with suid set that come from a RPM package">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_rpms:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_suid_all:var:1" version="1" datatype="string" comment="all files with suid set">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_suid_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_rpms:var:1" version="1" datatype="string" comment="all files with sgid set that come from a RPM package">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_rpms:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_file_permissions_unauthorized_sgid_all:var:1" version="1" datatype="string" comment="all files with sgid set">
                <object_component object_ref="oval:ssg-obj_file_permissions_unauthorized_sgid_files:obj:1" item_field="filepath"/>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_profile_umask_as_number:var:1" version="1" datatype="int" comment="/etc/profile umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_profile:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_profile:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_profile:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_login_defs_umask_as_number:var:1" version="1" datatype="int" comment="/etc/login.defs umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_login_defs:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_login_defs:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_login_defs:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_etc_init_d_functions_umask_as_number:var:1" version="1" datatype="int" comment="/etc/init.d/functions umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_etc_init_d_functions:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_etc_init_d_functions:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_etc_init_d_functions:var:1"/>
                </arithmetic>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_local_keyfiles_modified_time:var:1" version="1" datatype="int" comment="When dconf keyfiles in the 'local' tree have been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_local_config:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <local_variable id="oval:ssg-var_dconf_local_db_modified_time:var:1" version="1" datatype="string" comment="When the 'local' dconf DB has been modified">
                <time_difference format_2="seconds_since_epoch">
                  <object_component object_ref="oval:ssg-obj_dconf_local_db:obj:1" item_field="m_time"/>
                </time_difference>
              </local_variable>
              <external_variable id="oval:ssg-var_auditd_space_left_percentage:var:1" version="1" datatype="int" comment="audit space_left setting"/>
              <external_variable id="oval:ssg-var_auditd_space_left_action:var:1" version="2" datatype="string" comment="audit space_left_action setting"/>
              <external_variable id="oval:ssg-var_auditd_num_logs:var:1" version="1" datatype="int" comment="audit num_logs setting"/>
              <external_variable id="oval:ssg-var_auditd_max_log_file_action:var:1" version="1" datatype="string" comment="audit max_log_file_action setting"/>
              <external_variable id="oval:ssg-var_auditd_max_log_file:var:1" version="1" datatype="int" comment="audit max_log_file setting"/>
              <external_variable id="oval:ssg-var_auditd_flush:var:1" version="1" datatype="string" comment="audit flush setting"/>
              <external_variable id="oval:ssg-var_auditd_disk_full_action:var:1" version="1" datatype="string" comment="audit disk_full_action setting"/>
              <external_variable id="oval:ssg-var_auditd_disk_error_action:var:1" version="1" datatype="string" comment="audit disk_error_action setting"/>
              <external_variable id="oval:ssg-var_auditd_admin_space_left_action:var:1" version="1" datatype="string" comment="audit admin_space_left_action setting"/>
              <external_variable id="oval:ssg-var_auditd_action_mail_acct:var:1" version="1" datatype="string" comment="audit action_mail_acct setting"/>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_openat_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_openat_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a1&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(?:unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_order_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_a201003_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_TRUNC EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;01003)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_trunc_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_separator_regex:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>(?:[^.]|\.\s)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_64bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eperm_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_a20100_eacces_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at O_CREAT EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_32bit_head:var:1"/>
                  <literal_component>(?:-F\s+a2&amp;0100)[\s]+(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_audit_rule_open_by_handle_at_o_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_audit_rule_access_var_log_audit_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_64bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_openat_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(openat)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open)(?:,[\S]+)*)[\s]+(?:-F[\s]+a1&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_shadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/shadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_passwd_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/passwd)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_gshadow_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/gshadow)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_audit_rule_32bit_open_by_handle_at_write_tc_group_regex:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:-S[\s]+(?:[\S]+,)*(open_by_handle_at)(?:,[\S]+)*)[\s]+(?:-F[\s]+a2&amp;03)[\s]+(?:-F[\s]+path=/etc/group)[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <external_variable id="oval:ssg-var_audispd_remote_server:var:1" version="1" datatype="string" comment="audispd remote_server setting"/>
              <constant_variable id="oval:ssg-var_arufm_unlinkat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_unlink_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_truncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_setxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_64bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_openat_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eperm_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_eacces_augenrules_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_augenrules:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_by_handle_at_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eperm_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eperm_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_arufm_rule_order_32bit_open_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_32bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_32bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_renameat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_rename_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_removexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_openat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_openat_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_openat_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_open_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_open_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_open_by_handle_at_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_arufm_open_by_handle_at_order_64bit_auditctl_eacces_regex:var:1" version="1" datatype="string" comment="arches to audit">
                <concat>
                  <literal_component>^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$\n(^(?!</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a201003_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>|</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_64bit_a20100_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>).*$\n)*^</literal_component>
                  <object_component object_ref="oval:ssg-object_arufm_open_by_handle_at_order_nofilter_64bit_eacces_auditctl:obj:1" item_field="text"/>
                  <literal_component>$</literal_component>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_arufm_lsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_lremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_lchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_ftruncate_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fsetxattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fremovexattr_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchownat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchmodat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_fchmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_creat_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_chown_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_arufm_chmod_tail:var:1" version="1" datatype="string" comment="audit rule auid and key">
                <value>[\s]+(?:-F\s+auid&gt;=1000[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_accounts_user_umask_umask_as_number:var:1" version="1" datatype="int" comment="var_accounts_user_umask umask converted from string to a number">
                <arithmetic arithmetic_operation="add">
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">64</literal_component>
                    <variable_component var_ref="oval:ssg-var_first_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                  </arithmetic>
                  <arithmetic arithmetic_operation="multiply">
                    <literal_component datatype="int">8</literal_component>
                    <variable_component var_ref="oval:ssg-var_second_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                  </arithmetic>
                  <variable_component var_ref="oval:ssg-var_third_digit_of_umask_from_var_accounts_user_umask:var:1"/>
                </arithmetic>
              </local_variable>
              <external_variable id="oval:ssg-var_accounts_user_umask:var:1" version="1" datatype="string" comment="Value of var_accounts_user_umask (the required umask) as string"/>
              <external_variable id="oval:ssg-var_accounts_tmout:var:1" version="1" datatype="int" comment="external variable for TMOUT"/>
              <local_variable id="oval:ssg-var_accounts_root_path_dirs_no_write:var:1" version="1" datatype="string" comment="Split the PATH on the : delimiter">
                <split delimiter=":">
                  <object_component object_ref="oval:ssg-object_accounts_root_path_dirs_no_write_pathenv:obj:1" item_field="value"/>
                </split>
              </local_variable>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1" version="2" datatype="int" comment="lockout time for failed password attempts"/>
              <local_variable id="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_system-auth:var:1" version="1" datatype="string" comment="Regex containing skipped lines">
                <concat>
                  <literal_component>pam_unix(?:.*[\n](?:.*[\n]){</literal_component>
                  <object_component object_ref="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_system-auth:obj:1" item_field="subexpression"/>
                  <literal_component>})(?:.*[\n])*auth.*pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lines_regex_password-auth:var:1" version="1" datatype="string" comment="Regex containing skipped lines">
                <concat>
                  <literal_component>^[^#]*pam_unix(?:.*[\n](?:.*[\n]){</literal_component>
                  <object_component object_ref="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_password-auth:obj:1" item_field="subexpression"/>
                  <literal_component>})(?:.*[\n])*auth.*pam_faillock.so[\s]+[^\n]*deny=([0-9]+)</literal_component>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_fail_interval:var:1" version="2" datatype="int" comment="number of failed login attempts allowed"/>
              <external_variable id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1" version="1" datatype="int" comment="number of failed login attempts allowed"/>
              <external_variable id="oval:ssg-var_accounts_password_warn_age_login_defs:var:1" version="1" datatype="int" comment="password expiration warning age in days"/>
              <external_variable id="oval:ssg-var_accounts_password_minlen_login_defs:var:1" version="1" datatype="int" comment="Password minimum length"/>
              <external_variable id="oval:ssg-var_accounts_minimum_age_login_defs:var:1" version="1" datatype="int" comment="Minimum password age in days"/>
              <external_variable id="oval:ssg-var_accounts_maximum_age_login_defs:var:1" version="1" datatype="int" comment="Maximum password age"/>
              <external_variable id="oval:ssg-var_accounts_max_concurrent_login_sessions:var:1" version="1" datatype="int" comment="maximum number of concurrent logins per user"/>
              <external_variable id="oval:ssg-var_accounts_fail_delay:var:1" version="1" datatype="int" comment="Expected fail_delay"/>
              <external_variable id="oval:ssg-var_accounts_authorized_local_users_regex:var:1" version="1" datatype="string" comment="accounts authorized local users on operating system"/>
              <external_variable id="oval:ssg-var_account_disable_post_pw_expiration:var:1" version="1" datatype="int" comment="inactive days expiration"/>
              <constant_variable id="oval:ssg-var_64bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EPERM syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlinkat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit unlink EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit truncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit setxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit renameat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit rename EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit removexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit openat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit open_by_handle_at EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit lchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit ftruncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchownat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmodat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit fchmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit creat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_64bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 64bit chmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_64bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_64bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_unlinkat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_unlink_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_truncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+truncate[\s]+|([\s]+|[,])truncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_setxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+setxattr[\s]+|([\s]+|[,])setxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_renameat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_rename_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_removexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+removexattr[\s]+|([\s]+|[,])removexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_openat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+openat[\s]+|([\s]+|[,])openat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_open_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open[\s]+|([\s]+|[,])open([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+open_by_handle_at[\s]+|([\s]+|[,])open_by_handle_at([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lsetxattr[\s]+|([\s]+|[,])lsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lremovexattr[\s]+|([\s]+|[,])lremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_lchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+lchown[\s]+|([\s]+|[,])lchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_ftruncate_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+ftruncate[\s]+|([\s]+|[,])ftruncate([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fsetxattr[\s]+|([\s]+|[,])fsetxattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fremovexattr[\s]+|([\s]+|[,])fremovexattr([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchownat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchownat[\s]+|([\s]+|[,])fchownat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchown[\s]+|([\s]+|[,])fchown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchmodat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmodat[\s]+|([\s]+|[,])fchmodat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_fchmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+fchmod[\s]+|([\s]+|[,])fchmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eperm_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EPERM EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EPERM)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_unlinkat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlinkat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlinkat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlinkat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_unlink_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit unlink EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_unlink_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_unlink_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_truncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit truncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_truncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_truncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_setxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit setxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_setxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_setxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_renameat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit renameat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_renameat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_renameat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_rename_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit rename EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_rename_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_rename_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_removexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit removexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_removexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_removexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_openat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit openat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_openat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_openat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_open_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_open_by_handle_at_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit open_by_handle_at EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_open_by_handle_at_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_open_by_handle_at_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_lchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit lchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_lchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_lchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_ftruncate_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit ftruncate EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_ftruncate_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_ftruncate_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fsetxattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fsetxattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fsetxattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fsetxattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fremovexattr_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fremovexattr EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fremovexattr_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fremovexattr_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchownat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchownat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchownat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchownat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmodat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmodat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmodat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmodat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_fchmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit fchmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_fchmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_fchmod_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_creat_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit creat EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_creat_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_creat_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_chown_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chown EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chown_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chown_tail:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-var_32bit_arufm_eacces_chmod_regex:var:1" version="1" datatype="string" comment="Expression to match 32bit chmod EACCES syscall">
                <concat>
                  <variable_component var_ref="oval:ssg-var_32bit_arufm_chmod_head:var:1"/>
                  <literal_component>(?:-F\s+exit=-EACCES)</literal_component>
                  <variable_component var_ref="oval:ssg-var_arufm_chmod_tail:var:1"/>
                </concat>
              </local_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_creat_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+creat[\s]+|([\s]+|[,])creat([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_chown_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <constant_variable id="oval:ssg-var_32bit_arufm_chmod_head:var:1" version="1" datatype="string" comment="audit rule arch and syscal">
                <value>^[\s]*-a[\s]+always,exit[\s]+(?:-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:(?!-F[\s]+a\d&amp;).)*</value>
              </constant_variable>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.router_solicitations"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.max_addresses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.autoconf"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_rtr_pref"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_pinfo"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.default.accept_ra_defrtr"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.router_solicitations"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.max_addresses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.autoconf"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_rtr_pref"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_pinfo"/>
              <external_variable id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr_value:var:1" version="1" datatype="int" comment="External variable for net.ipv6.conf.all.accept_ra_defrtr"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_tcp_syncookies_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.tcp_syncookies"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_ignore_bogus_error_responses"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.icmp_echo_ignore_broadcasts"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.secure_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.rp_filter"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.log_martians"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_source_route"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.default.accept_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.secure_redirects"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.rp_filter"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.log_martians"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_source_route"/>
              <external_variable id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects_value:var:1" version="1" datatype="int" comment="External variable for net.ipv4.conf.all.accept_redirects"/>
              <external_variable id="oval:ssg-sshd_required:var:1" version="1" datatype="int" comment="May be defined by Profiles to explicitly say if sshd is required or not"/>
              <external_variable id="oval:ssg-sshd_max_auth_tries_value:var:1" version="1" datatype="int" comment="maxauthtries value"/>
              <local_variable id="oval:ssg-sshd_macs_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>MACs </literal_component>
                  <variable_component var_ref="oval:ssg-sshd_approved_macs:var:1"/>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-sshd_line_regex:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^[\s]*RekeyLimit[\s]+</literal_component>
                  <variable_component var_ref="oval:ssg-var_rekey_limit_size:var:1"/>
                  <literal_component>[\s]+</literal_component>
                  <variable_component var_ref="oval:ssg-var_rekey_limit_time:var:1"/>
                  <literal_component>[\s]*$</literal_component>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-sshd_idle_timeout_value:var:1" version="1" datatype="int" comment="timeout value"/>
              <local_variable id="oval:ssg-sshd_ciphers_crypto:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>Ciphers </literal_component>
                  <variable_component var_ref="oval:ssg-sshd_approved_ciphers:var:1"/>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-sshd_approved_macs:var:1" version="1" datatype="string" comment="SSH Approved MACs by FIPS"/>
              <external_variable id="oval:ssg-sshd_approved_ciphers:var:1" version="1" datatype="string" comment="SSH Approved Ciphers by FIPS"/>
              <external_variable id="oval:ssg-rsyslog_remote_loghost_address:var:1" version="1" datatype="string" comment="used for remediation only"/>
              <local_variable id="oval:ssg-pwhistory_line_regex_system_auth:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^\s*password\s+(?:</literal_component>
                  <variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
                  <literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</literal_component>
                </concat>
              </local_variable>
              <local_variable id="oval:ssg-pwhistory_line_regex_password_auth:var:1" version="1" datatype="string" comment="The regex of the directive">
                <concat>
                  <literal_component>^\s*password\s+(?:</literal_component>
                  <variable_component var_ref="oval:ssg-var_password_pam_remember_control_flag:var:1"/>
                  <literal_component>)\s+pam_pwhistory\.so.*remember=([0-9]*).*$</literal_component>
                </concat>
              </local_variable>
              <external_variable id="oval:ssg-login_banner_text:var:1" version="1" datatype="string" comment="warning banner text variable"/>
              <external_variable id="oval:ssg-inactivity_timeout_value:var:1" version="1" datatype="int" comment="inactivity timeout variable"/>
              <local_variable id="oval:ssg-file_permissions_unowned_userid_list:var:1" version="1" datatype="int" comment="List of valid user ids">
                <object_component object_ref="oval:ssg-file_permissions_unowned_userid_list_object:obj:1" item_field="user_id"/>
              </local_variable>
            </variables>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:ssg-xwindows_runlevel_target:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-wireless_disable_interfaces:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_umask_for_daemons_as_number:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-var_accounts_user_umask_as_number:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-use_pam_wheel_for_su:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hub:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hid_and_hub:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-usbguard_allow_hid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-usbguard_rules_not_empty_not_missing:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-umask_for_daemons:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_umask_for_daemons_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_umask_for_daemons:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-timer_dnf-automatic_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dnf-automatic_installed:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_x86_64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_x86:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_s390_64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_ppc_64:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_aarch_64:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_info_architecture_64bit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86_64:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_ppc_64:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_aarch_64:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_s390_64:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_non_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_user_max_user_namespaces:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_user_max_user_namespaces:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_kernel_core_pattern:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_user_max_user_namespaces:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_router_solicitations:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_router_solicitations:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_router_solicitations:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_max_addresses:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_max_addresses:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_max_addresses:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_disable_ipv6:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_autoconf:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_autoconf:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_autoconf:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_pinfo:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra_defrtr:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_default_accept_ra:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_default_accept_ra:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_router_solicitations:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_router_solicitations:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_router_solicitations:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_max_addresses:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_max_addresses:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_max_addresses:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_disable_ipv6:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_autoconf:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_autoconf:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_autoconf:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_pinfo:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv6_conf_all_accept_ra_defrtr:def:1" result="not evaluated" version="4">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_tcp_syncookies:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_tcp_syncookies:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_tcp_syncookies:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_ip_local_port_range:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_local_port_range:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_local_port_range:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_send_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_send_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_secure_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_secure_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_rp_filter:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_rp_filter:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_log_martians:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_log_martians:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_source_route:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_source_route:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_default_accept_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_send_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_send_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_secure_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_secure_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_rp_filter:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_rp_filter:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_log_martians:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_log_martians:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_source_route:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_source_route:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv4_conf_all_accept_redirects:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv4_conf_all_accept_redirects:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_net_core_bpf_jit_harden:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_net_core_bpf_jit_harden:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_core_bpf_jit_harden:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_yama_ptrace_scope:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_yama_ptrace_scope:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_yama_ptrace_scope:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_unprivileged_bpf_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_unprivileged_bpf_disabled:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_unprivileged_bpf_disabled:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_sysrq:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_pid_max:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_modules_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_modules_disabled:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_modules_disabled:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_kexec_load_disabled:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_kexec_load_disabled:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_kexec_load_disabled:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_ipv6_disable:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sysctl_static_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sysctl_runtime_net_ipv6_conf_all_disable_ipv6:def:1" version="3" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_exec_shield:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_nx_disabled_grub:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_kernel_core_pattern:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_kernel_core_pattern:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_kernel_core_pattern:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_suid_dumpable:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_symlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sysctl_crypto_fips_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_validate_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_no_root_target:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_user_spec_rules:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_no_command_negation:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudoers_explicit_command_args:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_vdsm_nopasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_require_authentication:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sudo_remove_no_authenticate:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sudo_remove_nopasswd:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_remove_nopasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_remove_no_authenticate:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_custom_logfile:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logfile_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_use_pty:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_use_pty_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_requiretty:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_requiretty_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sudo_add_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_noexec_sudoers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_ssh_known_hosts_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_run_as_sssd_user:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_offline_cred_expiration:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_memcache_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_enable_smartcards:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_sssd_disabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sssd_conf_exists:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_enable_certmap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_uses_ldap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_exists:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_conf_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_certificate_verification:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_x11_use_localhost:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_openssh-server_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_use_priv_separation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_use_directory_configuration:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_includes_config_files:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_maxstartups:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_max_sessions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_max_sessions:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_max_auth_tries:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_sshd_disabled:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_loglevel_verbose:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_loglevel_info:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_keepalive_0:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_keepalive:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_set_idle_timeout:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-sshd_set_keepalive:def:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_requirement_unset:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_required_or_unset:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sshd_required:tst:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_rekey_limit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_print_last_log:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_not_required_or_unset:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sshd_not_required:tst:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sshd_requirement_unset:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_includes_config_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_x11_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_warning_banner:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_strictmodes:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_enable_gssapi_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_do_not_permit_user_env:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_x11_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_user_known_hosts:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_tcp_forwarding:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_root_password_login:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_root_login:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_rhosts_rsa:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_rhosts:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_pubkey_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_kerb_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_gssapi_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_empty_passwords:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_disable_compression:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sshd_disable_compression:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sshd_allow_only_protocol2:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-sshd_version_equal_or_higher_than_74:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-snmpd_use_newer_protocol:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_net-snmp_removed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_snmp_versions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-snmpd_not_default_password:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_snmp_default_communities:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-smartcard_auth:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_smartcard_packages:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-service_pcscd_enabled:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-package_esc_installed:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_systemauth:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_pam_unix_sha512:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_logindefs:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_password_hashing_algorithm_libuserconf:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-set_firewalld_default_zone:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_firewalld_input_drop:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_usbguard_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_usbguard:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_systemd-coredump_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_syslogng_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_syslogng:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_syslogng:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_syslog_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_syslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_sssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_sssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_sshd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_sshd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rsyslog_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rsyncd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcsvcgssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcidmapd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rpcgssd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_rngd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_rngd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_pcscd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_pcscd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ntpd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ntpd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ntp_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ntp:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_nfslock_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_nfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_netfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_netfs:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_iptables_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_iptables:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_ip6tables_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_ip6tables:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_firewalld_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_firewalld:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_debug-shell_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_crond_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_crond:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_cron_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_cron:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_chronyd_or_ntpd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_chronyd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_chronyd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_bluetooth_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_autofs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_autofs:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_auditd_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_running_auditd:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-service_atd_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_service_not_running_atd:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_state:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_selinux_config:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_policytype:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_selinux_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_confinement_of_daemons:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-selinux_all_devicefiles_labeled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-securetty_root_login_console_only:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_tls_cacert:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_tls:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_loghost:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_remote_access_monitoring:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_nolisten:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_permissions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_ownership:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_files_groupownership:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_defaultnetstreamdriver:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdrivermode:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_encrypt_offload_actionsendstreamdriverauthmode:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rsyslog_cron_logging:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rpm_verify_permissions:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-rpm_verify_hashes:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-root_permissions_syslibrary_files:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-root_path_no_dot:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_var_begins:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_ends:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_begins_slash:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-restrict_serial_port_logins:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-require_singleuser_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_require_rescue_service:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-require_emergency_target_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_require_emergency_service:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-removable_partition_doesnt_exist:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-prefer_64bit_os:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-postfix_client_configure_mail_alias:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var_log_audit:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_log_audit_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_log_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_var:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testvar_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_usr:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testusr_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testtmp_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_srv:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testsrv_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_opt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testopt_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_home:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testhome_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-partition_for_boot:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-testboot_partition:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_xorg-x11-server-common_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vsftpd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vsftpd_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_vim_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_usbguard_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_usbguard_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tuned_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tuned_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tmux_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tmux_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_telnetd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_telnetd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_telnetd-ssl_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_tar_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_tar_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_syslogng_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_syslogng_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sudo_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sssd-ipa_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot-server_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_setroubleshoot-plugins_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_sendmail_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_sendmail_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_screen_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_screen_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_scap-security-guide_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_samba-common_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_samba-common_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rsyslog_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rsyslog-gnutls_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rng-tools_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_rear_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_rear_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_prelink_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_prelink_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_policycoreutils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_pcsc-lite_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_pam_ldap_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openssh-server_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openssh-server_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openscap-scanner_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_opensc_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_opensc_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_openldap-clients_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_ntpdate_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_ntp_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nss-tools_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nis_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nis_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_nfs-utils_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_net-snmp_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_mcstrans_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libselinux_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libselinux_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libreswan_installed:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_package_libreswan_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_libcap-ng-utils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_krb5-workstation_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_iptables_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_iptables_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_iprutils_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_iprutils_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_inetutils-telnetd_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gssproxy_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gnutls-utils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_geolite2-country_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_geolite2-city_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gdm_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gdm_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_gdm_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_gdm_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_fapolicyd_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_esc_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_esc_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_dnf-automatic_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_dconf_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_dconf_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_cryptsetup-luks_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_cron_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_cron_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_chrony_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_binutils_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_binutils_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_bind_removed:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_package_bind_removed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_avahi_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_avahi_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audit_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audit-audispd-plugins_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_audispd-plugins_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_aide_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_aide_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-sosreport_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-rhtsupport_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-plugin-logger_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-cli_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-addon-python_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-addon-python_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-addon-kerneloops_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_abrt-addon-ccpp_removed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_MFEhiplsm_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-package_GConf2_installed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_GConf2_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_specify_remote_server:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntp_remote_server:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_specify_multiple_servers:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_run_as_ntp_user:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ntpd_configure_restrictions:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_tmux_in_shells:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_shelllogin_for_systemaccounts:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_rsh_trust_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_netrc_files:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_netrc_files_home:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_legacy_plus_entries_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_insecure_locks_exports:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_files_unowned_by_user:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_empty_passwords:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_empty_passwords:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_direct_root_logins:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_direct_root_logins:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_etc_securetty_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_sniffer_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_promisc_interfaces:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_nmcli_permissions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_static_address:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_privacy_extensions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_disable_rpc:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_ipv6_default_gateway:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-sysctl_kernel_ipv6_disable:def:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-network_disable_zeroconf:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_tmp_bind:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_var_log_audit_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_tmp_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_srv_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_opt_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nosuid_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_noexec_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nodev_removable_partitions:def:1" result="not evaluated" version="5">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-removable_partition_doesnt_exist:def:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-var_removable_partition_is_cd_dvd_drive:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                        <extend_definition definition_ref="oval:ssg-no_cd_dvd_drive_in_etc_fstab:def:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_nodev_nonroot_local_partitions:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_home_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_dev_shm_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_nosuid:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_noexec:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_nodev:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-mount_option_boot_noauto:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-logwatch_configured_splithosts:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-logwatch_configured_hostlimit:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_vfat_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_usb-storage_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_udf_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_tipc_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_squashfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_rds_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_jffs2_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_ipv6_option_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_hfsplus_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_hfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_freevxfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_firewire-core_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_dccp_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_cramfs_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_can_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_bluetooth_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kernel_module_atm_disabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-kerberos_disable_no_keytab:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_machine:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_container:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_zipl_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_yum_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_systemd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sudo_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sssd-common_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_postfix_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_pam_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ntp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_net-snmp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_login_defs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_libuser_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_grub2_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_gdm_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_chrony_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_audit_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhosp13:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhosp13_release:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhosp10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhosp10_release:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux1019:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_vendor_supported:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_lsb:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu2004:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1804:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1604:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle15_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle12:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle12_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel9:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_6:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_5:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_3:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_2:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_1:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_0:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel8:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhcos4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhcos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhcos4:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_unix_family:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol8_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol8_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol7_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol7_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_fedora:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian9:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian10:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos8:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_FIPS_certified:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle12:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_sle15:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_smartcard_packages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss_pa:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss_accm:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_hbss:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_accm:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-package_MFEhiplsm_installed:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss_pa:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_cma_rt:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_mcafee_management_agent:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_mcafee_antivirus:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_cma_rt:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_hids:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_hbss:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_enforcing:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_antivirus:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-install_mcafee_antivirus:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-install_PAE_kernel_on_x86-32:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_macs_openssh_conf_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-harden_ssh_client_crypto_policy:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_vsyscall_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_uefi_password:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_bootloader_uefi_superuser:tst:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_uefi_admin_username:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_slub_debug_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_pti_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_password:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <criterion test_ref="oval:ssg-test_bootloader_superuser:tst:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_page_poison_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_nousb_argument:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_ipv6_disable_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_enable_selinux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_selinux_default_grub:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_selinux_grub_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_enable_iommu_force:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_disable_interactive_boot:def:1" result="not evaluated" version="4">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_default_exists:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_default_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_audit_backlog_limit_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_audit_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-grub2_admin_username:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_bootloader_unique_superuser:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_xdmcp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_guest_login:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_disable_guest_login:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gnome_gdm_disable_automatic_login:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_gdm_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_disable_automatic_login:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-gid_passwd_group_same:def:1" result="true" version="2">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ftp_present_banner:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_vsftpd_removed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ftp_present_banner:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ftp_log_transactions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_vsftpd_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-force_opensc_card_drivers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_messages:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log_audit:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_var_log:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_ungroupowned:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_world_writable:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_suid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_unauthorized_sgid:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_systemmap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_sshd_pub_key:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_sshd_private_key:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_sshd_private_key:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_perms_lib_dir:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_perms_lib_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_home_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_grub2_cfg:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_shadow:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_shadow:tst:1" version="2" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_passwd:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_passwd:tst:1" version="2" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_motd:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_issue:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_gshadow:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_group:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_group:tst:1" version="2" result="true" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_audit_rulesd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_etc_audit_auditd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_binary_dirs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_perms_binary_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_permissions_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_permissions_backup_etc_group:tst:1" version="2" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_var_log_audit:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ownership_lib_dir:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ownership_lib_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_ownership_binary_dirs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_ownership_binary_directories:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ownership_binary_files:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_var_log_messages:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_var_log:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_shadow:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_shadow:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_passwd:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_motd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_issue:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_etc_group:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_owner_etc_group:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_shadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_passwd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_owner_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_owner_backup_etc_group:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupownership_system_commands_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_var_log_messages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_var_log_messages:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_var_log:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_var_log:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_shadow:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_shadow:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_passwd:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_motd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_motd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_issue:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_issue:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_etc_group:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_efi_grub2_cfg:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-file_groupowner_backup_etc_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_file_groupowner_backup_etc_group:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-etc_system_fips_exists:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_system_fips:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_logrotate_activated:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_never_disabled:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_local_packages:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_gpgcheck_globally_activated:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-ensure_fedora_gpgkey_installed:def:1" result="true" version="2">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_fedora:def:1" version="3" result="true"/>
                    <criteria operator="OR" result="true">
                      <criterion test_ref="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" result="true"/>
                      <criterion test_ref="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1" version="1" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_pam_namespace:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_enable_pam_namespace:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_fips_mode:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-etc_system_fips_exists:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-sysctl_crypto_fips_enabled:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-enable_dracut_fips_module:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-configure_crypto_policy:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_FIPS_certified:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_dracut_fips_module:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-enable_dconf_user_profile:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criterion test_ref="oval:ssg-test_dconf_user_profile:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dnf-automatic_security_updates_only:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dnf-automatic_apply_updates:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-display_login_attempts:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_display_login_attempts:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_users_coredumps:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_host_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_not_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_removed:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-sshd_required_or_unset:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-package_openssh-server_installed:def:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_disable_host_auth:tst:1" version="1" result="not evaluated"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                        <criterion test_ref="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-disable_ctrlaltdel_reboot:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-directory_permissions_var_log_audit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-auditd_conf_log_group_not_root:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-directory_access_var_log_audit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_system_owned_group:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_system_owned:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_sticky_bits:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_perms_world_writable_root_owned:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated" negate="true">
                    <criterion test_ref="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_permissions_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-dir_test_perms_lib_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dir_ownership_lib_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dir_group_ownership_library_dirs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dir_group_ownership_lib_dir:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_session_idle_user_locks:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_user_locks:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_user_info:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_info_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_mode_blank:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_locked:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_enabled:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_lock_delay:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_lock_delay:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_delay:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_idle_delay:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_activation_locked:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_screensaver_idle_activation_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_remote_access_encryption:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_remote_access_credential_prompt:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_login_retries:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_configure_allowed_failures:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_login_banner_text:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_lock_screen_on_smartcard_removal:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_enable_smartcard_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_wifi_notification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_wifi_notification:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_wifi_create:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_wifi_creation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_user_list:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_user_list:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_user_admin:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_thumbnailers:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_restart_shutdown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_restart_buttons:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_power_settings:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_geolocation:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_ctrlaltdel_reboot:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_autorun:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_automount_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_disable_automount:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_gnome_banner_enabled:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-enable_dconf_user_profile:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_banner_gui_enabled:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-dconf_db_up_to_date:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_dconf_installed:def:1" version="1" result="not evaluated" negate="true"/>
                    <criteria operator="AND" result="not evaluated">
                      <criteria operator="OR" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coreos_enable_selinux_kernel_argument:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" result="not evaluated" negate="true"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" result="not evaluated" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coredump_disable_storage:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_coredump_disable_storage:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-coredump_disable_backtraces:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_usbguard_auditbackend:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_tmux_lock_command:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_tmux_lock_after_time:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_ssh_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_openssl_crypto_policy:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_opensc_nss_db:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_opensc_card_drivers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_libreswan_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_libreswan_installed:def:1" version="1" result="true" negate="true"/>
                    <criterion test_ref="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_kerberos_crypto_policy:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_gnutls_tls_crypto_policy:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_configure_crypto_policy:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_crypto_policies_updated:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_bind_crypto_policy:def:1" result="true" version="1">
                  <criteria operator="OR" result="true">
                    <extend_definition definition_ref="oval:ssg-package_bind_removed:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-configure_bashrc_exec_tmux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_specify_remote_server:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_chronyd_remote_server:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_specify_multiple_servers:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_run_as_chrony_user:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criterion test_ref="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_specify_remote_server:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-chronyd_specify_remote_server:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-ntpd_specify_remote_server:def:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_specify_multiple_servers:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-chronyd_specify_multiple_servers:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-service_ntpd_enabled:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-ntpd_specify_multiple_servers:def:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_or_ntpd_set_maxpoll:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_no_chronyc_network:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-chronyd_client_only:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-service_chronyd_enabled:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_chronyd_client_only:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-bootloader_disable_recovery_set_to_true:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-bios_enable_execution_restrictions:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_NX_cpu_support:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_messages_nx_active:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_noexec_cmd_line:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-banner_etc_motd:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_banner_etc_motd:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-banner_etc_issue:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_banner_etc_issue:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_write_logs:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_write_logs:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_overflow_action:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_overflow_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_name_format:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_name_format:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_log_format:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_log_format:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_local_events:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_local_events:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_freq:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_freq:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_space_left_percentage:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_space_left_action:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_num_logs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_max_log_file_action:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_max_log_file:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_flush:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_admin_space_left_action:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_retention_action_mail_acct:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_disk_full_action:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_data_disk_error_action:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_conf_log_group_not_root:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_syslog_plugin_activated:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_encrypt_sent_records:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-auditd_audispd_configure_remote_server:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_shadow:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_opasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_gshadow:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification_group:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_usergroup_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_unlinkat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_unlink:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_setxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_renameat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_rename:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_removexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_rule_order:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_trunc_write:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat_o_creat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_rule_order:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_trunc_write:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_o_creat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lsetxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lremovexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_lchown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fsetxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fremovexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchownat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmodat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_fchmod:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_chown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification_chmod:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criteria operator="AND" result="not evaluated">
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                          <criterion test_ref="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                        </criteria>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_unsuccessful_file_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_creat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_ftruncate:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_openat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_open:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_unsuccessful_file_modification_truncate:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_watch_localtime:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_stime:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_x86:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="OR" result="not evaluated">
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                      <criteria operator="AND" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_settimeofday:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_clock_settime:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_time_adjtimex:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_sysadmin_actions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_session_events:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_usernetctl:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_userhelper:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_unix_chkpwd:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_umount:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_sudoedit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_sudo:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_su:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_ssh_keysign:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_pt_chown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_passwd:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newuidmap:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newgrp:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_newgidmap:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_mount:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_gpasswd:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_crontab:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_chsh:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_chage:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_privileged_commands:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_networkconfig_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_hostname:def:1" version="1" result="not evaluated"/>
                      <extend_definition definition_ref="oval:ssg-audit_rules_networkconfig_modification_domainname:def:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_media_export:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_mac_modification:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_tallylog:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_lastlog:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events_faillock:def:1" result="not evaluated" version="2">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_login_events:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_tallylog:def:1" version="2" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_faillock:def:1" version="2" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_login_events_lastlog:def:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_init:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_kernel_module_loading:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_init:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_delete:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_kernel_module_loading_finit:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_immutable:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events_rename:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_file_deletion_events:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rmdir:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlink:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_unlinkat:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_rename:def:1" version="1" result="not evaluated"/>
                    <extend_definition definition_ref="oval:ssg-audit_rules_file_deletion_events_renameat:def:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_seunshare:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_setsebool:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_semanage:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_restorecon:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_execution_chcon:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_openat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_open_by_handle_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_shadow_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_openat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_open_by_handle_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_passwd_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_openat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_open_by_handle_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_gshadow_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_openat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_open_by_handle_at:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_etc_group_open:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_enable_syscall_auditing:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_umount:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_umount2:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_setxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_removexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lsetxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lremovexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_lchown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fsetxattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fremovexattr:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchownat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchmodat:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_fchmod:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_chown:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_dac_modification_chmod:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_augenrules:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                    <criteria operator="AND" result="not evaluated">
                      <extend_definition definition_ref="oval:ssg-audit_rules_auditctl:def:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="OR" result="not evaluated">
                        <extend_definition definition_ref="oval:ssg-system_info_architecture_64bit:def:1" version="1" result="not evaluated" negate="true"/>
                        <criterion test_ref="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_augenrules:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-audit_rules_auditctl:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_periodic_cron_checking:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_crond_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_check_audit_tools:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_auditd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_aureport:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_autrace:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_audispd:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-aide_build_database:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-package_aide_installed:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_umask_etc_profile:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_umask_etc_login_defs:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-var_accounts_user_umask_as_number:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_tmout:def:1" result="not evaluated" version="3">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_profile_tmout:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_root_path_dirs_no_write:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_polyinstantiated_var_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_polyinstantiated_tmp:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_tmp_inst:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" version="1" result="false"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1" version="3" result="false"/>
                    </criteria>
                    <criteria operator="AND" result="false">
                      <criterion test_ref="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" version="1" result="true" negate="true"/>
                      <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1" version="3" result="false"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_interval:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1" version="2" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_enforce_local:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_faillock:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_deny_root:def:1" result="not evaluated" version="4">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_passwords_pam_faillock_deny:def:1" result="false" version="4">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" version="2" result="false"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" version="2" result="false"/>
                    <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" version="1" result="false"/>
                    <criteria operator="AND" result="false">
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" version="2" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" version="2" result="false"/>
                      </criteria>
                      <criteria operator="OR" result="false">
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" version="2" result="false"/>
                        <criterion test_ref="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" version="2" result="false"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_warn_age_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_warn_age:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_rounds_system_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_rounds_password_auth:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_unix_remember:def:1" result="false" version="2">
                  <criteria operator="OR" result="false">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_ucredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_retry:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwquality:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_ocredit:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_minlen:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_minclass:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_maxrepeat:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_maxclassrepeat:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_lcredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_faillock:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_enforce_root:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_enforce_local:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_difok:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_dictcheck:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_pam_dcredit:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-accounts_password_pam_pwquality:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_minlen_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_min_len:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_all_shadowed_sha512:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_password_all_shadowed:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_no_uid_except_zero:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_minimum_age_login_defs:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_pass_min_days:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_maximum_age_login_defs:def:1" result="false" version="3">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_pass_max_days:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_max_concurrent_login_sessions:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" result="not evaluated" negate="true"/>
                      <criterion test_ref="oval:ssg-test_maxlogins:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_logon_fail_delay:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_have_homedir_login_defs:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-accounts_authorized_local_users:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_unique_name:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_unique_id:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-account_disable_post_pw_expiration:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:ssg-dir_test_perms_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-no_files_unowned_by_user_test:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_init_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_init_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_mount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_mount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount2_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount2_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_umount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_adjtimex_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_adjtimex_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_clock_settime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_clock_settime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_settimeofday_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_settimeofday_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_stime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_art_stime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_32bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_delete_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_delete_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_finit_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_finit_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_init_module_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_init_module_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_mount_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_mount_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setdomainname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setdomainname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_sethostname_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_sethostname_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_umount2_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_umount2_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_adjtimex_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_adjtimex_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_clock_settime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_clock_settime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_settimeofday_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_art_settimeofday_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_creat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_creat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_ftruncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_ftruncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_openat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_openat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_truncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_truncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eacces_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_chown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_creat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_creat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmod_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmod_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmodat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchmodat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchownat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fchownat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_fsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_ftruncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_ftruncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lchown_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lchown_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lremovexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_lsetxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_open_by_handle_at_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_openat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_openat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_removexattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_removexattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_rename_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_rename_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_renameat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_renameat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_setxattr_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_setxattr_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_truncate_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_truncate_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlink_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlink_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlinkat_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_64bit_arufm_eperm_unlinkat_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_PAE_NX_cpu_support:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_authorized_local_users:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_have_homedir_login_defs:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_logon_fail_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_no_uid_except_root:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_all_shadowed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_all_shadowed_sha512:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_enforce_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_enforce_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_faillock:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_unix_remember:var:1">4</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_password_pam_unix_remember:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_unix_remember:var:1">4</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_password-auth:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_account_phase_system-auth:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_account_requires_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_deny_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_authfail_fail_interval_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_enforce_local:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_fail_interval_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_numeric_default_check_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_fail_interval_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_password-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_preauth_silent_system-auth:tst:1" version="2" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_deny:var:1">6</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_greater_or_equal_ext_var:tst:1" version="3" check_existence="all_exist" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">1800</tested_variable>
                </test>
                <test test_id="oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_is_never:tst:1" version="3" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_build_new_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_crond_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_crontabs_checking:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_operational_database_absolute_path:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_periodic_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_var_cron_checking:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_audispd:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_auditd:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_aureport:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_ausearch:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_aide_verify_autrace:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ari_locked_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ari_locked_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_faillock_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_faillock_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_lastlog_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_lastlog_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_tallylog_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arle_tallylog_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_armm_selinux_watch_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_armm_selinux_watch_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_hosts_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_hosts_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_net_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_issue_net_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_sysconfig_network_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arnm_etc_sysconfig_network_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_bin_count_equals_rules_count_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_bin_count_equals_rules_count_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_suid_sgid_auditctl:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arpc_suid_sgid_augenrules:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_btmp_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_btmp_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_utmp_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_utmp_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_wtmp_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arse_wtmp_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_artw_etc_localtime_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_artw_etc_localtime_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_by_handle_at_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_open_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_32bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_creat_64bit_a20100_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_32bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_o_trunc_64bit_a201003_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_32bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eacces_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eacces_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eperm_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_arufm_openat_order_64bit_eperm_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_restorecon_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_restorecon_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_semanage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_semanage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_seunshare_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_execution_seunshare_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_at_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_at_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chage_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chage_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chsh_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_chsh_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_crontab_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_crontab_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_gpasswd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgrp_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newgrp_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_newuidmap_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_passwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_passwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_pt_chown_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_ssh_keysign_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_su_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_su_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudo_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudo_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_sudoedit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_umount_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_umount_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_unix_chkpwd_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_userhelper_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_userhelper_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_privileged_commands_usernetctl_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_sysadmin_actions_sudoers_d_augenrules:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_group_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_gshadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_passwd_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_open_by_handle_at_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_32bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_tc_shadow_openat_64bit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_group_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_gshadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_passwd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_security_opasswd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_etc_shadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_group_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_group_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_gshadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_opasswd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_passwd_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_passwd_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_shadow_auditctl:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_audit_rules_usergroup_modification_shadow_augen:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_audispd_configure_remote_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_audispd_encrypt_sent_records:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_audispd_syslog_plugin_activated:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_conf_log_group_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_conf_log_group_not_root:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_disk_error_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_disk_full_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_admin_space_left_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_flush:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_max_log_file:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_max_log_file_action:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_num_logs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_space_left_action:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_data_retention_space_left_percentage:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_freq:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_local_events:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_local_events_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_log_format:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_name_format:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_overflow_action:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_write_logs:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_auditd_write_logs_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_banner_etc_issue:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_banner_etc_motd:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_banner_gui_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_noauto_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_boot_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_disable_recovery_set_to_true:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_superuser:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_uefi_superuser:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_uefi_unique_superuser:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_bootloader_unique_superuser:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chrony_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chrony_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_client_only:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_no_chronyc_network:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_remote_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_run_as_chrony_user:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_chronyd_run_as_chrony_user_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_allowed_failures:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_bashrc_exec_tmux:tst:1" version="1" check_existence="only_one_exists" check="only one" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_bind_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_crypto_policy:tst:1" version="1" check_existence="only_one_exists" check="all" result="true">
                  <tested_item item_id="10009213" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_system_crypto_policy:var:1">DEFAULT</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_crypto_policy_current:tst:1" version="1" check_existence="only_one_exists" check="all" result="true">
                  <tested_item item_id="10009214" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_system_crypto_policy:var:1">DEFAULT</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_gnutls_tls_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_kerberos_crypto_policy_nosymlink:tst:1" version="1" check_existence="all_exist" check="all" result="false">
                  <tested_item item_id="10009220" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_kerberos_crypto_policy_symlink:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009220" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_backend:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</tested_variable>
                </test>
                <test test_id="oval:ssg-test_configure_libreswan_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_mount_option_var_tmp_bind_tmp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_opensc_nss_db:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_openssl_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_configure_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_ssh_crypto_policy:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_configure_tmux_lock_after_time:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_tmux_lock_command:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_usbguard_auditbackend:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_configure_usbguard_auditbackend_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limits_d:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limits_d_exists:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_core_dumps_limitsconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coredump_disable_backtraces:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coredump_disable_storage:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_file_boot_loader_entries_ostree_2_conf_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_1_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_boot_loader_entries_ostree_2_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_coreos_enable_selinux_kernel_argument_selinux_0_argument_in_proc_cmdline:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_cron_daily_logrotate_existence:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_cron_logging_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_cron_logging_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_crypto_policies_updated:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009216" result="true"/>
                  <tested_variable variable_id="oval:ssg-variable_crypto_policies_current_file_timestamp:var:1">1637822935</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1">1637822935</tested_variable>
                </test>
                <test test_id="oval:ssg-test_crypto_policy_nss_config:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009218" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_dconf_gnome_disable_automount:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_automount_open:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_autorun:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_disable_user_admin:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_gnome_lock_screen_on_smartcard_removal:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_local_no_keyfiles:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_local_up_to_date:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dconf_user_profile:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_defaultkernel_sysconfig_kernel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_group_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_permissions_var_log_audit-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_permissions_var_log_audit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_gid_gt_value:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_uid_gt_value:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dir_world_writable_uid_gt_zero:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_directory_acccess_var_log_audit_auditctl:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_directory_acccess_var_log_audit_augenrules:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_automatic_login:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_ctrlaltdel_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_gnome_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_gnome_power_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_guest_login:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_host_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_host_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_host_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_host_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_disable_xwindows_runlevel_target:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_display_login_attempts:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_display_login_attempts_silent:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_dnf-automatic_apply_updates:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dnf-automatic_apply_updates_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dnf-automatic_security_updates_only:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_dnf-automatic_security_updates_only_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_dracut_fips_module:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_gnome_smartcard:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_pam_namespace:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_syscall_audit_auditctl:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_enable_syscall_audit_augenrules:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009229" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_ensure_gpgcheck_never_disabled:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_begins:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_begins_slash:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_doublecolon:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_doubleperiod:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_contains_relative_path:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_var_ends:tst:1" version="1" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_default_useradd_inactive:tst:1" version="1" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_account_disable_post_pw_expiration:var:1">90</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_libuser_conf_cryptstyle:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_login_defs_encrypt_method:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10009235" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_password_hashing_algorithm:var:1">SHA512</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_last_encrypt_method_instance_value:var:1">YESCRYPT</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009251" result="true"/>
                  <tested_variable variable_id="oval:ssg-variable_count_of_unique_usernames_from_etc_passwd:var:1">15</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1">15</tested_variable>
                </test>
                <test test_id="oval:ssg-test_etc_profile_tmout:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_profiled_tmout:tst:1" version="2" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_securetty_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_selinux_config:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_etc_system_fips:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_existence_of_var_umask_for_daemons_as_number_variable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009223" result="not evaluated"/>
                  <tested_item item_id="10009225" result="not evaluated"/>
                  <tested_item item_id="10009224" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009226" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_group:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_gshadow:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_passwd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_backup_etc_shadow:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_efi_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_group:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009296" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_groupowner_etc_gshadow:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_issue:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_etc_passwd:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009297" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_groupowner_etc_shadow:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009298" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_groupowner_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_var_log:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_groupowner_var_log_messages:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_group:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_gshadow:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_passwd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_backup_etc_shadow:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_efi_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_group:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009296" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_owner_etc_gshadow:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_issue:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_motd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_etc_passwd:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009297" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_owner_etc_shadow:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009298" result="true"/>
                </test>
                <test test_id="oval:ssg-test_file_owner_grub2_cfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_var_log:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_owner_var_log_messages:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_group:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_gshadow:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_passwd:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_backup_etc_shadow:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_efi_grub2_cfg:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_audit_auditd:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_audit_rulesd:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_group:tst:1" version="2" check="all" result="false"/>
                <test test_id="oval:ssg-test_file_permissions_etc_gshadow:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_issue:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_motd:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_etc_passwd:tst:1" version="2" check="all" result="false"/>
                <test test_id="oval:ssg-test_file_permissions_etc_shadow:tst:1" version="2" check="all" result="false"/>
                <test test_id="oval:ssg-test_file_permissions_grub2_cfg:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_home_dirs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_sshd_private_key:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_sshd_pub_key:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_sgid:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_suid:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_unauthorized_world_write:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_ungroupowned:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_audit-non_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_audit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_file_permissions_var_log_messages:tst:1" version="2" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_files_fail_md5_hash:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_firewalld_input_drop:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_force_opensc_card_drivers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_enable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_format:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_log_transactions_protocol:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ftp_present_banner:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gdm_login_banner_text_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gid_passwd_group_same:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009254" result="true"/>
                  <tested_item item_id="10009261" result="true"/>
                  <tested_item item_id="10009262" result="true"/>
                  <tested_item item_id="10009259" result="true"/>
                  <tested_item item_id="10009260" result="true"/>
                  <tested_item item_id="10009258" result="true"/>
                  <tested_item item_id="10009267" result="true"/>
                  <tested_item item_id="10009268" result="true"/>
                  <tested_item item_id="10009265" result="true"/>
                  <tested_item item_id="10009266" result="true"/>
                  <tested_item item_id="10009263" result="true"/>
                  <tested_item item_id="10009264" result="true"/>
                  <tested_item item_id="10009255" result="true"/>
                  <tested_item item_id="10009256" result="true"/>
                  <tested_item item_id="10009257" result="true"/>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">2</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">3</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">4</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">5</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">6</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">1</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">0</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">7</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">8</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">9</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">10</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">11</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">12</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">15</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">18</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">19</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">20</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">33</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">39</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">50</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">54</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">63</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">100</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">65534</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">59</tested_variable>
                  <tested_variable variable_id="oval:ssg-var_gid_passwd_group_same:var:1">81</tested_variable>
                </test>
                <test test_id="oval:ssg-test_gnome_disable_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gnome_gdm_disable_xdmcp:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_gnome_gdm_disable_xdmcp_config_file_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_groupownership_system_commands_dirs:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_audit_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_audit_backlog_limit_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_default_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_disable_interactive_boot_grub_cmdline_linux_default:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_iommu_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_ipv6_disable_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_nousb_argument:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_page_poison_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_pti_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_slub_debug_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_uefi_admin_username_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_uefi_password_file_boot_grub2_grub_cfg_absent:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_uefi_password_grubcfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_uefi_password_usercfg:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_grub2_vsyscall_argument_grub_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_Ciphers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_GSSAPIAuthentication:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_KexAlgorithms:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_MACs:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_Match:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_PubkeyAcceptedKeyTypes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_ssh_client_crypto_policy_RekeyLimit:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_ciphers_openssh_conf_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_crypto_policy:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_harden_sshd_macs_openssh_conf_crypto_policy:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_home_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kerberos_disable_no_keytab:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernel_module_ipv6_option_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_atm_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_bluetooth_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_can_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_cramfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_dccp_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_firewire-core_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_freevxfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_hfsplus_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_jffs2_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_rds_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_squashfs_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_tipc_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_udf_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_usb-storage_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_etcmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_libmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_libmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_modprobeconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_runmodprobed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_kernmod_vfat_runmodules-load:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_limitsd_maxlogins:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_limitsd_maxlogins_exists:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_linuxshield_install_antivirus:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logfile_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logrotate_conf_daily_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logrotate_conf_no_other_keyword:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logwatch_configured_hostlimit:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_logwatch_configured_splithosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_maxlogins:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_accm_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_auditengine_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_management_agent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mcafee_runtime_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_messages_nx_active:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp_bind:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_mount_option_var_tmp_bind_compare_source:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_auditd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_auditd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_chronyd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_chronyd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_cron:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_cron_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_crond:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_crond_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_dnf-automatic:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_firewalld:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_firewalld_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ip6tables:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ip6tables_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_iptables:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_iptables_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntp:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntp_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntpd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_ntpd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_pcscd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_pcscd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rngd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rngd_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rsyslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_syslogng:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_syslogng_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_usbguard:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_multi_user_wants_usbguard_socket:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_default_gateway:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_disable_rpc_tcp6:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_disable_rpc_udp6:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_privacy_extensions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_ipv6_static_address:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_network_nmcli_permissions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_authenticate_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_authenticate_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_cd_dvd_drive_in_etc_fstab:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_emergency_service:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_emergency_target:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_rescue_service:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_custom_runlevel1_target:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_direct_root_logins:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_empty_passwords:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_insecure_locks_exports:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_group:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_passwd:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_legacy_plus_entries_etc_shadow:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_netrc_files_home:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_root_or_ALL_in_runas_spec:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_etc:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_home:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_rsh_trust_files_root:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_tmux_in_shells:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_no_user_spec_rules:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_nodev_nonroot_local_partitions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_cmd_line:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_noexec_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nosuid_etc_fstab_cd_dvd_drive:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nosuid_etc_fstab_not_cd_dvd_drive:tst:1" version="1" check_existence="all_exist" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_all_server_has_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_remote_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntp_set_maxpoll:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_configure_restrictions_ipv4:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_configure_restrictions_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_multiple_servers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_run_as_ntp_user_etc_sysconfig_ntpd:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ntpd_run_as_ntp_user_systemd:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_nx_disabled_grub:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_openssh-server_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opt_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_binary_directories:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_binary_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_lib_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_directories-non_root:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_directories:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_files-non_root:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ownership_var_log_audit_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_GConf2_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_MFEhiplsm_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-addon-ccpp_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-addon-kerneloops_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-addon-python_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-cli_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-logger_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-rhtsupport_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt-plugin-sosreport_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_abrt_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_aide_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audit-audispd-plugins_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_avahi_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_bind_removed:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_package_binutils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_cryptsetup-luks_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_dconf_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_dnf-automatic_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_esc_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_fapolicyd_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gdm_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gdm_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_geolite2-city_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_geolite2-country_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gnutls-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_gpgkey-45719a39-5f2c0192_installed:tst:1" version="1" check="only one" result="false">
                  <tested_item item_id="10009227" result="false"/>
                </test>
                <test test_id="oval:ssg-test_package_gpgkey-9570ff31-5e3006fb_installed:tst:1" version="1" check="only one" result="false">
                  <tested_item item_id="10009227" result="false"/>
                </test>
                <test test_id="oval:ssg-test_package_gpgkey-9867c58f-601c49ca_installed:tst:1" version="1" check="only one" result="true">
                  <tested_item item_id="10009227" result="true"/>
                </test>
                <test test_id="oval:ssg-test_package_gssproxy_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_inetutils-telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_iprutils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_kernel-PAE_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_krb5-workstation_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libcap-ng-utils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_libreswan_installed:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_package_libselinux_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_mcstrans_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_net-snmp_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nis_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_nss-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_ntpdate_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openldap-clients_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_opensc_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openscap-scanner_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openssh-server_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_openssl-pkcs11_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_pam_ldap_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_policycoreutils_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_prelink_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rear_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rsyslog-gnutls_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_samba-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_scap-security-guide_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_screen_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_sendmail_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_setroubleshoot-plugins_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_setroubleshoot-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_setroubleshoot_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_sssd-ipa_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_sudo_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tar_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_telnetd-ssl_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_telnetd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tmux_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_tuned_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vim-enhanced_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vsftpd_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_vsftpd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_package_xorg-x11-server-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_faillock_authfail_deny_root_password-auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_faillock_authfail_deny_root_system-auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_faillock_preauth_silent_password-auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_faillock_preauth_silent_system-auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_pkcs11_cert_policy_ocsp_on:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_pam_unix_sha512:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_pass_max_days:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10009253" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_accounts_maximum_age_login_defs:var:1">90</tested_variable>
                  <tested_variable variable_id="oval:ssg-variable_last_pass_max_days_instance_value:var:1">99999</tested_variable>
                </test>
                <test test_id="oval:ssg-test_pass_min_days:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pass_min_len:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_pass_warn_age:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009232" result="not evaluated"/>
                  <tested_variable variable_id="oval:ssg-var_pam_pwquality_config_path:var:1">/etc/pam.d/system-auth</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_dcredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_dcredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_dictcheck:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_difok:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_lcredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_lcredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_maxclassrepeat:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_maxrepeat:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_minclass:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_minlen:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_minlen:var:1">7</tested_variable>
                </test>
                <test test_id="oval:ssg-test_password_pam_pwquality_ocredit:tst:1" version="3" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_password_pam_pwquality_ucredit:tst:1" version="3" check="all" result="false">
                  <tested_variable variable_id="oval:ssg-var_password_pam_ucredit:var:1">-1</tested_variable>
                </test>
                <test test_id="oval:ssg-test_permissions_systemmap_files:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_perms_binary_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_perms_lib_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_perms_lib_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_postfix_client_configure_mail_alias:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_allowed-failures_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_banner_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_banner_gui_enabled_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_change_gnome_thumbnailers:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_change_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_change_idle_activation_locked:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_change_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_clock_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_disable_smartcard:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_disable_user_list:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_ctrlaltdel:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_restart_buttons:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_wifi_creation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_enable_wifi_notification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_automount:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_automount_open:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_gnome_autorun:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_info_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_power_setting_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_remote_access_creds:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_remote_access_encryption:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_removal-action:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_lock:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_lock_locked:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_screensaver_mode_change:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_sys_geolocation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_prevent_user_user-administration-disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_cpuinfo_64_bit:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_promisc_interfaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_auth:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_authpriv:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_method_monitoring_daemon:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_rsyslog_conf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_remote_rsyslog_d:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_removable_partition_doesnt_exist:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_emergency_service:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_emergency_service_emergency_target:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_rescue_service:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_require_rescue_service_runlevel1:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_requiretty_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhosp10_release:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhosp13_release:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_root_permissions_for_syslibrary_files:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdriverauthmode_action_send_stream_driver_auth_mode_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_actionsendstreamdrivermode_action_send_stream_driver_mode_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_encrypt_offload_defaultnetstreamdriver_default_netstream_rsyslog_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_groupownership:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_ownership:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_files_permissions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_nolisten:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_remote_tls:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rsyslog_remote_tls_cacert:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_runtime_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_disable_user_info:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_idle_activation_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_idle_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_idle_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_lock_delay:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_lock_delay_setting:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_lock_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_screensaver_mode_blank:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_confinement_of_daemons:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_default_grub:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_dev_device_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_dev_unlabeled_t:tst:1" version="2" check_existence="any_exist" check="none satisfy" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_enforcing:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_grub2_cfg:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_grub_dir:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_selinux_policy:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_serial_ports_etc_securetty:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_atd_package_at_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_auditd_package_audit_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_autofs_package_autofs_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_bluetooth_package_bluez_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_chronyd_package_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_cron_package_cron_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_crond_package_cronie_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_debug-shell_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_ip6tables_package_iptables-ipv6_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_iptables_package_iptables_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_atd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_autofs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_netfs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_nfslock:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_sshd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_sssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_syslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_loadstate_is_masked_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_netfs_package_netfs_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_nfslock_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_atd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_autofs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_bluetooth:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_debug-shell:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_netfs:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_nfs-server:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_nfslock:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcidmapd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rpcsvcgssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_rsyncd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_sshd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_sssd:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_syslog:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_not_running_systemd-coredump:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_ntp_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_ntpd_package_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_pcscd_package_pcsc-lite_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rngd_package_rng-tools_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rpcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rpcidmapd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rpcsvcgssd_package_nfs-utils_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rsyncd_package_rsync-daemon_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_auditd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_chronyd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_cron:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_crond:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_firewalld:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_ip6tables:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_iptables:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_ntp:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_ntpd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_pcscd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_rngd:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_rsyslog:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_syslogng:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_running_usbguard:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_sshd_package_openssh-server_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_sssd_package_sssd-common_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_syslog_package_rsyslog_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_syslogng_package_syslogng_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_systemd-coredump_package_systemd_removed:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_service_usbguard_package_usbguard_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_default_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_shell_defined_reserved_uid_range:tst:1" version="1" check_existence="any_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_smart_card_enabled_system_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_smart_card_required_smartcard_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_smart_card_required_system_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_snmp_default_communities:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_snmp_versions:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_srv_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_allow_only_protocol2:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_clientalivecountmax:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_compression:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_empty_passwords_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_gssapi_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_kerb_auth_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_pubkey_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_pubkey_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_rhosts_rsa:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_login:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_root_password_login_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_tcp_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_tcp_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_user_known_hosts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_user_known_hosts_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_disable_x11_forwarding_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_do_not_permit_user_env_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_gssapi_auth:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_gssapi_auth_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_strictmodes_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_warning_banner_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_x11_forwarding:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_idle_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_includes_config_files:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_max_auth_tries:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_max_sessions:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_not_required:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_print_last_log:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_print_last_log_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_print_last_log_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_print_last_log_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_rekey_limit:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_required:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_requirement_unset:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_keepalive_0:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_keepalive_0_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_info_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_set_loglevel_verbose_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_use_directory_configuration_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_use_priv_separation:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost_config_dir:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost_config_dir_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sshd_x11_use_localhost_default_not_overriden:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_certificate_verification:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_conf_exists:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_enable_certmap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_enable_smartcards:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_memcache_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_offline_cred_expiration:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_run_as_sssd_user:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sssd_ssh_known_hosts_timeout:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_etc_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_run_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_exec_shield:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_sysctl_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_core_pattern:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_kexec_load_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_modules_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_sysrq:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_unprivileged_bpf_disabled:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_kernel_yama_ptrace_scope:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_core_bpf_jit_harden:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_all_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_log_martians:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_rp_filter:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_conf_default_send_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_forward:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_ip_local_port_range:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv4_tcp_syncookies:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_autoconf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_max_addresses:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_user_max_user_namespaces:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_static_usr_lib_sysctld_vm_mmap_min_addr:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_explicit_command_args:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_no_command_negation:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_rootpw_config:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_runaspw_config:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sudoers_targetpw_config:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sys_uid_max_not_defined:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sys_uid_min_not_defined:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysconfig_nozeroconf_yes:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_crypto_fips_enabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_hardlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_protected_symlinks:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_fs_suid_dumpable:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_core_pattern:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_dmesg_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_kexec_load_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_kptr_restrict:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_modules_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_cpu_time_max_percent:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_event_max_sample_rate:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_perf_event_paranoid:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_pid_max:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_randomize_va_space:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_sysrq:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_unprivileged_bpf_disabled:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_kernel_yama_ptrace_scope:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_core_bpf_jit_harden:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_all_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_accept_source_route:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_log_martians:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_rp_filter:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_secure_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_conf_default_send_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_echo_ignore_broadcasts:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_icmp_ignore_bogus_error_responses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_forward:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_ip_local_port_range:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv4_tcp_syncookies:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_all_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_defrtr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_pinfo:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_ra_rtr_pref:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_accept_redirects:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_autoconf:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_disable_ipv6:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_max_addresses:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_net_ipv6_conf_default_router_solicitations:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_user_max_user_namespaces:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sysctl_runtime_vm_mmap_min_addr:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_default_pam_unix_rounds_var:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_pam_unix_rounds_is_default:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_auth_pam_unix_rounds_is_set:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_crypto_policy_value:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_aarch_64:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_ppc_64:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_s390_64:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_x86:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_x86_64:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_timer_running_dnf-automatic:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_in_namespace_conf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_tmp_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009222" result="true"/>
                </test>
                <test test_id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_usbguard_rules_nonempty:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_use_pam_wheel_for_su:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_use_pty_sudoers:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_user_change_idle_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_user_change_lock_delay_lock:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_faillock_unlock_time_is_never:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10009231" result="false"/>
                  <tested_variable variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">1800</tested_variable>
                </test>
                <test test_id="oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_nodev_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_noexec_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_partition_nosuid_optional_yes:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_removable_partition_is_cd_dvd_drive:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_tmp_in_namespace_conf:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_var_tmp_tmp_inst:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_vdsm_nopasswd_etc_sudoers:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_vdsm_nopasswd_etc_sudoers_d:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_verify_all_rpms_mode:tst:1" version="1" check_existence="none_exist" check="all" result="true"/>
                <test test_id="oval:ssg-test_virtual_consoles_etc_securetty:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wireless_disable_interfaces:tst:1" version="1" check_existence="none_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_yum_ensure_gpgcheck_local_packages:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testboot_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testhome_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testopt_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testsrv_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testtmp_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testusr_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_log_audit_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_log_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-testvar_partition:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_accounts_umask_etc_login_defs:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_accounts_umask_etc_profile:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_full_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_rate_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_maxstartups_start_parameter:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-tst_umask_for_daemons:tst:1" version="1" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>cpe:/a:open-scap:oscap</oval:product_name>
                  <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
                  <oval:schema_version>5.11</oval:schema_version>
                  <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>35 (Container Image)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>e98bca166d82</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>10.0.2.100</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>fe80::a08a:71ff:fe1f:ac82</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:ssg-crypto_policies_config_file:obj:1" version="1" flag="complete">
                    <reference item_ref="10009215"/>
                  </object>
                  <object id="oval:ssg-crypto_policies_current_file:obj:1" version="1" flag="complete">
                    <reference item_ref="10009217"/>
                  </object>
                  <object id="oval:ssg-obj_display_login_attempts:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_display_login_attempts_silent:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_ensure_gpgcheck_never_disabled:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_pam_pwquality_config_path:var:1">/etc/pam.d/system-auth</variable_value>
                    <reference item_ref="10009232"/>
                  </object>
                  <object id="oval:ssg-obj_password_pam_pwquality_dcredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_lcredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_minlen:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_password_pam_pwquality_ucredit:obj:1" version="3" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_bind_removed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_test_package_libreswan_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_password_pam_pwhistory_remember:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_password_pam_unix_remember:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_password-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_account_phase_system-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_password-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_authfail_deny_system-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_password-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_lines_value_system-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_password-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_preauth_silent_system-auth:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_unlock_time:obj:1" version="2" flag="does not exist"/>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_password-auth:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lin</message>
                  </object>
                  <object id="oval:ssg-object_accounts_passwords_pam_faillock_when_lines_skipped_system-auth:obj:1" version="1" flag="does not exist">
                    <message level="warning">Referenced variable has no values (oval:ssg-var_accounts_passwords_pam_faillock_preauth_default_lin</message>
                  </object>
                  <object id="oval:ssg-object_configure_bind_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_configure_crypto_policy:obj:1" version="1" flag="complete">
                    <reference item_ref="10009213"/>
                  </object>
                  <object id="oval:ssg-object_configure_crypto_policy_current:obj:1" version="1" flag="complete">
                    <reference item_ref="10009214"/>
                  </object>
                  <object id="oval:ssg-object_configure_libreswan_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_configure_openssl_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_configure_ssh_crypto_policy:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_count_of_all_usernames_from_etc_passwd:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1">15</variable_value>
                    <reference item_ref="10009251"/>
                  </object>
                  <object id="oval:ssg-object_crypto_policies_config_file_modified_time:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-variable_crypto_policies_config_file_timestamp:var:1">1637822935</variable_value>
                    <reference item_ref="10009216"/>
                  </object>
                  <object id="oval:ssg-object_crypto_policy_nss_config:obj:1" version="1" flag="complete">
                    <reference item_ref="10009218"/>
                  </object>
                  <object id="oval:ssg-object_ensure_gpgcheck_globally_activated:obj:1" version="1" flag="complete">
                    <reference item_ref="10009229"/>
                  </object>
                  <object id="oval:ssg-object_etc_default_useradd_inactive:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_etc_passwd_content:obj:1" version="1" flag="complete">
                    <reference item_ref="10009247"/>
                    <reference item_ref="10009241"/>
                    <reference item_ref="10009237"/>
                    <reference item_ref="10009248"/>
                    <reference item_ref="10009249"/>
                    <reference item_ref="10009250"/>
                    <reference item_ref="10009245"/>
                    <reference item_ref="10009244"/>
                    <reference item_ref="10009238"/>
                    <reference item_ref="10009239"/>
                    <reference item_ref="10009243"/>
                    <reference item_ref="10009246"/>
                    <reference item_ref="10009236"/>
                    <reference item_ref="10009242"/>
                    <reference item_ref="10009240"/>
                  </object>
                  <object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1" flag="complete">
                    <reference item_ref="10009223"/>
                    <reference item_ref="10009225"/>
                    <reference item_ref="10009224"/>
                  </object>
                  <object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1" flag="complete">
                    <reference item_ref="10009226"/>
                  </object>
                  <object id="oval:ssg-object_file_groupowner_etc_group:obj:1" version="1" flag="complete">
                    <reference item_ref="10009296"/>
                  </object>
                  <object id="oval:ssg-object_file_groupowner_etc_passwd:obj:1" version="1" flag="complete">
                    <reference item_ref="10009297"/>
                  </object>
                  <object id="oval:ssg-object_file_groupowner_etc_shadow:obj:1" version="1" flag="complete">
                    <reference item_ref="10009298"/>
                  </object>
                  <object id="oval:ssg-object_file_owner_etc_group:obj:1" version="1" flag="complete">
                    <reference item_ref="10009296"/>
                  </object>
                  <object id="oval:ssg-object_file_owner_etc_passwd:obj:1" version="1" flag="complete">
                    <reference item_ref="10009297"/>
                  </object>
                  <object id="oval:ssg-object_file_owner_etc_shadow:obj:1" version="1" flag="complete">
                    <reference item_ref="10009298"/>
                  </object>
                  <object id="oval:ssg-object_file_permissions_etc_group:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_file_permissions_etc_passwd:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_file_permissions_etc_shadow:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_files_fail_md5_hash:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_files_fail_mode:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_gid_passwd_group_same:obj:1" version="1" flag="complete">
                    <reference item_ref="10009254"/>
                    <reference item_ref="10009261"/>
                    <reference item_ref="10009262"/>
                    <reference item_ref="10009259"/>
                    <reference item_ref="10009260"/>
                    <reference item_ref="10009258"/>
                    <reference item_ref="10009267"/>
                    <reference item_ref="10009268"/>
                    <reference item_ref="10009265"/>
                    <reference item_ref="10009266"/>
                    <reference item_ref="10009263"/>
                    <reference item_ref="10009264"/>
                    <reference item_ref="10009255"/>
                    <reference item_ref="10009256"/>
                    <reference item_ref="10009257"/>
                  </object>
                  <object id="oval:ssg-object_gid_passwd_group_same_var:obj:1" version="1" flag="complete">
                    <reference item_ref="10009271"/>
                    <reference item_ref="10009272"/>
                    <reference item_ref="10009273"/>
                    <reference item_ref="10009274"/>
                    <reference item_ref="10009275"/>
                    <reference item_ref="10009270"/>
                    <reference item_ref="10009269"/>
                    <reference item_ref="10009276"/>
                    <reference item_ref="10009277"/>
                    <reference item_ref="10009278"/>
                    <reference item_ref="10009279"/>
                    <reference item_ref="10009280"/>
                    <reference item_ref="10009281"/>
                    <reference item_ref="10009282"/>
                    <reference item_ref="10009283"/>
                    <reference item_ref="10009284"/>
                    <reference item_ref="10009285"/>
                    <reference item_ref="10009286"/>
                    <reference item_ref="10009287"/>
                    <reference item_ref="10009288"/>
                    <reference item_ref="10009289"/>
                    <reference item_ref="10009290"/>
                    <reference item_ref="10009291"/>
                    <reference item_ref="10009292"/>
                    <reference item_ref="10009293"/>
                    <reference item_ref="10009294"/>
                  </object>
                  <object id="oval:ssg-object_kerberos_crypto_policy_backend:obj:1" version="1" flag="complete">
                    <reference item_ref="10009221"/>
                  </object>
                  <object id="oval:ssg-object_kerberos_crypto_policy_configuration:obj:1" version="1" flag="complete">
                    <reference item_ref="10009219"/>
                  </object>
                  <object id="oval:ssg-object_last_encrypt_method_from_etc_login_defs:obj:1" version="1" flag="complete">
                    <reference item_ref="10009234"/>
                  </object>
                  <object id="oval:ssg-object_last_encrypt_method_instance_value:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-variable_last_encrypt_method_instance_value:var:1">YESCRYPT</variable_value>
                    <reference item_ref="10009235"/>
                  </object>
                  <object id="oval:ssg-object_last_pass_max_days_from_etc_login_defs:obj:1" version="1" flag="complete">
                    <reference item_ref="10009252"/>
                  </object>
                  <object id="oval:ssg-object_last_pass_max_days_instance_value:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-variable_last_pass_max_days_instance_value:var:1">99999</variable_value>
                    <reference item_ref="10009253"/>
                  </object>
                  <object id="oval:ssg-object_package_gpg-pubkey:obj:1" version="1" flag="complete">
                    <reference item_ref="10009227"/>
                  </object>
                  <object id="oval:ssg-object_pam_unix_sha512:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_symlink_kerberos_crypto_policy_configuration:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1">/usr/share/crypto-policies/DEFAULT/krb5.txt</variable_value>
                    <reference item_ref="10009220"/>
                  </object>
                  <object id="oval:ssg-object_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="10009222"/>
                  </object>
                  <object id="oval:ssg-object_var_faillock_unlock_time:obj:1" version="1" flag="complete">
                    <variable_value variable_id="oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1">1800</variable_value>
                    <reference item_ref="10009231"/>
                  </object>
                </collected_objects>
                <system_data>
                  <unix-sys:file_item id="10009298" status="exists">
                    <unix-sys:filepath>/etc/shadow</unix-sys:filepath>
                    <unix-sys:path>/etc</unix-sys:path>
                    <unix-sys:filename>shadow</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1640190793</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640190793</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1640190793</unix-sys:m_time>
                    <unix-sys:size datatype="int">386</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">false</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">false</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">false</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">false</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10009297" status="exists">
                    <unix-sys:filepath>/etc/passwd</unix-sys:filepath>
                    <unix-sys:path>/etc</unix-sys:path>
                    <unix-sys:filename>passwd</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1640190793</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640190793</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1640190793</unix-sys:m_time>
                    <unix-sys:size datatype="int">645</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10009296" status="exists">
                    <unix-sys:filepath>/etc/group</unix-sys:filepath>
                    <unix-sys:path>/etc</unix-sys:path>
                    <unix-sys:filename>group</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1640190793</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640190793</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1640190793</unix-sys:m_time>
                    <unix-sys:size datatype="int">285</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10009294" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">26</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>dbus:x:81:</ind-sys:text>
                    <ind-sys:subexpression>81</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009293" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">25</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>tss:x:59:</ind-sys:text>
                    <ind-sys:subexpression>59</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009292" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">24</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>nobody:x:65534:</ind-sys:text>
                    <ind-sys:subexpression>65534</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009291" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">23</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>users:x:100:</ind-sys:text>
                    <ind-sys:subexpression>100</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009290" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">22</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>audio:x:63:</ind-sys:text>
                    <ind-sys:subexpression>63</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009289" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">21</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>lock:x:54:</ind-sys:text>
                    <ind-sys:subexpression>54</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009288" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">20</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>ftp:x:50:</ind-sys:text>
                    <ind-sys:subexpression>50</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009287" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">19</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>video:x:39:</ind-sys:text>
                    <ind-sys:subexpression>39</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009286" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">18</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>tape:x:33:</ind-sys:text>
                    <ind-sys:subexpression>33</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009285" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">17</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>games:x:20:</ind-sys:text>
                    <ind-sys:subexpression>20</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009284" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">16</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>floppy:x:19:</ind-sys:text>
                    <ind-sys:subexpression>19</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009283" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">15</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>dialout:x:18:</ind-sys:text>
                    <ind-sys:subexpression>18</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009282" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">14</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>man:x:15:</ind-sys:text>
                    <ind-sys:subexpression>15</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009281" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">13</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>mail:x:12:</ind-sys:text>
                    <ind-sys:subexpression>12</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009280" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">12</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>cdrom:x:11:</ind-sys:text>
                    <ind-sys:subexpression>11</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009279" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">11</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>wheel:x:10:</ind-sys:text>
                    <ind-sys:subexpression>10</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009278" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">10</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>kmem:x:9:</ind-sys:text>
                    <ind-sys:subexpression>9</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009277" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">9</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>mem:x:8:</ind-sys:text>
                    <ind-sys:subexpression>8</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009276" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">8</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>lp:x:7:</ind-sys:text>
                    <ind-sys:subexpression>7</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009275" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">7</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>disk:x:6:</ind-sys:text>
                    <ind-sys:subexpression>6</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009274" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">6</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>tty:x:5:</ind-sys:text>
                    <ind-sys:subexpression>5</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009273" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">5</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>adm:x:4:</ind-sys:text>
                    <ind-sys:subexpression>4</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009272" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">4</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>sys:x:3:</ind-sys:text>
                    <ind-sys:subexpression>3</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009271" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">3</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>daemon:x:2:</ind-sys:text>
                    <ind-sys:subexpression>2</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009270" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">2</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>bin:x:1:</ind-sys:text>
                    <ind-sys:subexpression>1</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009269" status="exists">
                    <ind-sys:filepath>/etc/group</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>group</ind-sys:filename>
                    <ind-sys:pattern>^.*:x:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^.*:x:([0-9]+):</ind-sys:line>
                    <ind-sys:text>root:x:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009268" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">15</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>dbus:x:81:81:</ind-sys:text>
                    <ind-sys:subexpression>81</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009267" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">14</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>tss:x:59:59:</ind-sys:text>
                    <ind-sys:subexpression>59</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009266" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">13</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>nobody:x:65534:65534:</ind-sys:text>
                    <ind-sys:subexpression>65534</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009265" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">12</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>ftp:x:14:50:</ind-sys:text>
                    <ind-sys:subexpression>50</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009264" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">11</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>games:x:12:100:</ind-sys:text>
                    <ind-sys:subexpression>100</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009263" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">10</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>operator:x:11:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009262" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">9</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>mail:x:8:12:</ind-sys:text>
                    <ind-sys:subexpression>12</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009261" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">8</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>halt:x:7:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009260" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">7</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>shutdown:x:6:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009259" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">6</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>sync:x:5:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009258" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">5</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>lp:x:4:7:</ind-sys:text>
                    <ind-sys:subexpression>7</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009257" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">4</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>adm:x:3:4:</ind-sys:text>
                    <ind-sys:subexpression>4</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009256" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">3</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>daemon:x:2:2:</ind-sys:text>
                    <ind-sys:subexpression>2</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009255" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">2</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>bin:x:1:1:</ind-sys:text>
                    <ind-sys:subexpression>1</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009254" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^.*:[0-9]+:([0-9]+):</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^.*:[0-9]+:([0-9]+):</ind-sys:line>
                    <ind-sys:text>root:x:0:0:</ind-sys:text>
                    <ind-sys:subexpression>0</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:variable_item id="10009253" status="exists">
                    <ind-sys:var_ref>oval:ssg-variable_last_pass_max_days_instance_value:var:1</ind-sys:var_ref>
                    <ind-sys:value>99999</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10009252" status="exists">
                    <ind-sys:filepath>/etc/login.defs</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>login.defs</ind-sys:filename>
                    <ind-sys:pattern>^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(?:.*\n)*\s*[^#]*(PASS_MAX_DAYS\s+\d+)\s*\n</ind-sys:line>
                    <ind-sys:text>#
# Please note that the parameters in this configuration file control the
# behavior of the tools from the shadow-utils component. None of these
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
# passwd command) should therefore be configured elsewhere. Refer to
# /etc/pam.d/system-auth for more information.
#

#
# Delay in seconds before being allowed another attempt after a login failure
# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
#       pam_unix(8) enforces a 2s delay)
#
#FAIL_DELAY		3

# Currently FAILLOG_ENAB is not supported

#
# Enable display of unknown usernames when login(1) failures are recorded.
#
#LOG_UNKFAIL_ENAB	no

# Currently LOG_OK_LOGINS is not supported

# Currently LASTLOG_ENAB is not supported

#
# Limit the highest user ID number for which the lastlog entries should
# be updated.
#
# No LASTLOG_UID_MAX means that there is no user ID limit for writing
# lastlog entries.
#
#LASTLOG_UID_MAX

# Currently MAIL_CHECK_ENAB is not supported

# Currently OBSCURE_CHECKS_ENAB is not supported

# Currently PORTTIME_CHECKS_ENAB is not supported

# Currently QUOTAS_ENAB is not supported

# Currently SYSLOG_SU_ENAB is not supported

#
# Enable "syslog" logging of newgrp(1) and sg(1) activity.
#
#SYSLOG_SG_ENAB		yes

# Currently CONSOLE is not supported

# Currently SULOG_FILE is not supported

# Currently MOTD_FILE is not supported

# Currently ISSUE_FILE is not supported

# Currently TTYTYPE_FILE is not supported

# Currently FTMP_FILE is not supported

# Currently NOLOGINS_FILE is not supported

# Currently SU_NAME is not supported

# *REQUIRED*
#   Directory where mailboxes reside, _or_ name of file, relative to the
#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
#
MAIL_DIR	/var/spool/mail
#MAIL_FILE	.mail

#
# If defined, file which inhibits all the usual chatter during the login
# sequence.  If a full pathname, then hushed mode will be enabled if the
# user's name or shell are found in the file.  If not a full pathname, then
# hushed mode will be enabled if the file exists in the user's home directory.
#
#HUSHLOGIN_FILE	.hushlogin
#HUSHLOGIN_FILE	/etc/hushlogins

# Currently ENV_TZ is not supported

# Currently ENV_HZ is not supported

#
# The default PATH settings, for superuser and normal users.
#
# (they are minimal, add the rest in the shell startup files)
#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
#ENV_PATH	PATH=/bin:/usr/bin

#
# Terminal permissions
#
#	TTYGROUP	Login tty will be assigned this group ownership.
#	TTYPERM		Login tty will be set to this permission.
#
# If you have a write(1) program which is "setgid" to a special group
# which owns the terminals, define TTYGROUP as the number of such group
# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
# set TTYPERM to either 622 or 600.
#
#TTYGROUP	tty
#TTYPERM		0600

# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported

# Default initial "umask" value used by login(1) on non-PAM enabled systems.
# Default "umask" value for pam_umask(8) on PAM enabled systems.
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
# home directories if HOME_MODE is not set.
# 022 is the default value, but 027, or even 077, could be considered
# for increased privacy. There is no One True Answer here: each sysadmin
# must make up their mind.
UMASK		022

# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
# home directories.
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
HOME_MODE	0700

# Password aging controls:
#
#	PASS_MAX_DAYS	Maximum number of days a password may be used.
#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
#	PASS_MIN_LEN	Minimum acceptable password length.
#	PASS_WARN_AGE	Number of days warning given before a password expires.
#
PASS_MAX_DAYS	99999
</ind-sys:text>
                    <ind-sys:subexpression>PASS_MAX_DAYS	99999</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:variable_item id="10009251" status="exists">
                    <ind-sys:var_ref>oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1</ind-sys:var_ref>
                    <ind-sys:value>15</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10009250" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">15</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>dbus:x:81:81:System message bus:/:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>dbus</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009249" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">14</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>tss:x:59:59:Account used for TPM access:/dev/null:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>tss</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009248" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">13</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>nobody</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009247" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">12</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>ftp</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009246" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">11</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>games:x:12:100:games:/usr/games:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>games</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009245" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">10</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>operator:x:11:0:operator:/root:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>operator</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009244" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">9</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>mail:x:8:12:mail:/var/spool/mail:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>mail</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009243" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">8</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>halt:x:7:0:halt:/sbin:/sbin/halt</ind-sys:text>
                    <ind-sys:subexpression>halt</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009242" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">7</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown</ind-sys:text>
                    <ind-sys:subexpression>shutdown</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009241" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">6</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>sync:x:5:0:sync:/sbin:/bin/sync</ind-sys:text>
                    <ind-sys:subexpression>sync</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009240" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">5</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>lp</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009239" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">4</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>adm:x:3:4:adm:/var/adm:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>adm</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009238" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">3</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>daemon:x:2:2:daemon:/sbin:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>daemon</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009237" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">2</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>bin:x:1:1:bin:/bin:/sbin/nologin</ind-sys:text>
                    <ind-sys:subexpression>bin</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009236" status="exists">
                    <ind-sys:filepath>/etc/passwd</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>passwd</ind-sys:filename>
                    <ind-sys:pattern>^([^:]+):.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^([^:]+):.*$</ind-sys:line>
                    <ind-sys:text>root:x:0:0:root:/root:/bin/bash</ind-sys:text>
                    <ind-sys:subexpression>root</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:variable_item id="10009235" status="exists">
                    <ind-sys:var_ref>oval:ssg-variable_last_encrypt_method_instance_value:var:1</ind-sys:var_ref>
                    <ind-sys:value>YESCRYPT</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10009234" status="exists">
                    <ind-sys:filepath>/etc/login.defs</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>login.defs</ind-sys:filename>
                    <ind-sys:pattern>.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>.*\n[^#]*(ENCRYPT_METHOD\s+\w+)\s*\n</ind-sys:line>
                    <ind-sys:text>#
# Please note that the parameters in this configuration file control the
# behavior of the tools from the shadow-utils component. None of these
# tools uses the PAM mechanism, and the utilities that use PAM (such as the
# passwd command) should therefore be configured elsewhere. Refer to
# /etc/pam.d/system-auth for more information.
#

#
# Delay in seconds before being allowed another attempt after a login failure
# Note: When PAM is used, some modules may enforce a minimum delay (e.g.
#       pam_unix(8) enforces a 2s delay)
#
#FAIL_DELAY		3

# Currently FAILLOG_ENAB is not supported

#
# Enable display of unknown usernames when login(1) failures are recorded.
#
#LOG_UNKFAIL_ENAB	no

# Currently LOG_OK_LOGINS is not supported

# Currently LASTLOG_ENAB is not supported

#
# Limit the highest user ID number for which the lastlog entries should
# be updated.
#
# No LASTLOG_UID_MAX means that there is no user ID limit for writing
# lastlog entries.
#
#LASTLOG_UID_MAX

# Currently MAIL_CHECK_ENAB is not supported

# Currently OBSCURE_CHECKS_ENAB is not supported

# Currently PORTTIME_CHECKS_ENAB is not supported

# Currently QUOTAS_ENAB is not supported

# Currently SYSLOG_SU_ENAB is not supported

#
# Enable "syslog" logging of newgrp(1) and sg(1) activity.
#
#SYSLOG_SG_ENAB		yes

# Currently CONSOLE is not supported

# Currently SULOG_FILE is not supported

# Currently MOTD_FILE is not supported

# Currently ISSUE_FILE is not supported

# Currently TTYTYPE_FILE is not supported

# Currently FTMP_FILE is not supported

# Currently NOLOGINS_FILE is not supported

# Currently SU_NAME is not supported

# *REQUIRED*
#   Directory where mailboxes reside, _or_ name of file, relative to the
#   home directory.  If you _do_ define both, MAIL_DIR takes precedence.
#
MAIL_DIR	/var/spool/mail
#MAIL_FILE	.mail

#
# If defined, file which inhibits all the usual chatter during the login
# sequence.  If a full pathname, then hushed mode will be enabled if the
# user's name or shell are found in the file.  If not a full pathname, then
# hushed mode will be enabled if the file exists in the user's home directory.
#
#HUSHLOGIN_FILE	.hushlogin
#HUSHLOGIN_FILE	/etc/hushlogins

# Currently ENV_TZ is not supported

# Currently ENV_HZ is not supported

#
# The default PATH settings, for superuser and normal users.
#
# (they are minimal, add the rest in the shell startup files)
#ENV_SUPATH	PATH=/sbin:/bin:/usr/sbin:/usr/bin
#ENV_PATH	PATH=/bin:/usr/bin

#
# Terminal permissions
#
#	TTYGROUP	Login tty will be assigned this group ownership.
#	TTYPERM		Login tty will be set to this permission.
#
# If you have a write(1) program which is "setgid" to a special group
# which owns the terminals, define TTYGROUP as the number of such group
# and TTYPERM as 0620.  Otherwise leave TTYGROUP commented out and
# set TTYPERM to either 622 or 600.
#
#TTYGROUP	tty
#TTYPERM		0600

# Currently ERASECHAR, KILLCHAR and ULIMIT are not supported

# Default initial "umask" value used by login(1) on non-PAM enabled systems.
# Default "umask" value for pam_umask(8) on PAM enabled systems.
# UMASK is also used by useradd(8) and newusers(8) to set the mode for new
# home directories if HOME_MODE is not set.
# 022 is the default value, but 027, or even 077, could be considered
# for increased privacy. There is no One True Answer here: each sysadmin
# must make up their mind.
UMASK		022

# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new
# home directories.
# If HOME_MODE is not set, the value of UMASK is used to create the mode.
HOME_MODE	0700

# Password aging controls:
#
#	PASS_MAX_DAYS	Maximum number of days a password may be used.
#	PASS_MIN_DAYS	Minimum number of days allowed between password changes.
#	PASS_MIN_LEN	Minimum acceptable password length.
#	PASS_WARN_AGE	Number of days warning given before a password expires.
#
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_WARN_AGE	7

# Currently PASS_MIN_LEN is not supported

# Currently SU_WHEEL_ONLY is not supported

# Currently CRACKLIB_DICTPATH is not supported

#
# Min/max values for automatic uid selection in useradd(8)
#
UID_MIN                  1000
UID_MAX                 60000
# System accounts
SYS_UID_MIN               201
SYS_UID_MAX               999
# Extra per user uids
SUB_UID_MIN		   100000
SUB_UID_MAX		600100000
SUB_UID_COUNT		    65536

#
# Min/max values for automatic gid selection in groupadd(8)
#
GID_MIN                  1000
GID_MAX                 60000
# System accounts
SYS_GID_MIN               201
SYS_GID_MAX               999
# Extra per user group ids
SUB_GID_MIN		   100000
SUB_GID_MAX		600100000
SUB_GID_COUNT		    65536

#
# Max number of login(1) retries if password is bad
#
#LOGIN_RETRIES		3

#
# Max time in seconds for login(1)
#
#LOGIN_TIMEOUT		60

# Currently PASS_CHANGE_TRIES is not supported

# Currently PASS_ALWAYS_WARN is not supported

# Currently PASS_MAX_LEN is not supported

# Currently CHFN_AUTH is not supported

#
# Which fields may be changed by regular users using chfn(1) - use
# any combination of letters "frwh" (full name, room number, work
# phone, home phone).  If not defined, no changes are allowed.
# For backward compatibility, "yes" = "rwh" and "no" = "frwh".
# 
#CHFN_RESTRICT		rwh

# Currently LOGIN_STRING is not supported

# Currently MD5_CRYPT_ENAB is not supported

#
# If set to MD5, MD5-based algorithm will be used for encrypting password
# If set to SHA256, SHA256-based algorithm will be used for encrypting password
# If set to SHA512, SHA512-based algorithm will be used for encrypting password
# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password
# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password
# If set to DES, DES-based algorithm will be used for encrypting password (default)
#
ENCRYPT_METHOD YESCRYPT

</ind-sys:text>
                    <ind-sys:subexpression>ENCRYPT_METHOD YESCRYPT</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009232" status="exists">
                    <ind-sys:filepath>/etc/pam.d/system-auth</ind-sys:filepath>
                    <ind-sys:path>/etc/pam.d</ind-sys:path>
                    <ind-sys:filename>system-auth</ind-sys:filename>
                    <ind-sys:pattern>^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*$</ind-sys:line>
                    <ind-sys:text>
password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:variable_item id="10009231" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_accounts_passwords_pam_faillock_unlock_time:var:1</ind-sys:var_ref>
                    <ind-sys:value>1800</ind-sys:value>
                  </ind-sys:variable_item>
                  <ind-sys:textfilecontent_item id="10009229" status="exists">
                    <ind-sys:filepath>/etc/dnf/dnf.conf</ind-sys:filepath>
                    <ind-sys:path>/etc/dnf</ind-sys:path>
                    <ind-sys:filename>dnf.conf</ind-sys:filename>
                    <ind-sys:pattern>^\s*gpgcheck\s*=\s*1\s*$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^\s*gpgcheck\s*=\s*1\s*$</ind-sys:line>
                    <ind-sys:text>gpgcheck=1</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:rpminfo_item id="10009227" status="exists">
                    <lin-sys:name>gpg-pubkey</lin-sys:name>
                    <lin-sys:arch>(none)</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>601c49ca</lin-sys:release>
                    <lin-sys:version>9867c58f</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:9867c58f-601c49ca</lin-sys:evr>
                    <lin-sys:signature_keyid>0</lin-sys:signature_keyid>
                    <lin-sys:extended_name>gpg-pubkey-0:9867c58f-601c49ca.(none)</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:textfilecontent_item id="10009226" status="exists">
                    <ind-sys:filepath>/etc/system-release-cpe</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>system-release-cpe</ind-sys:filename>
                    <ind-sys:pattern>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:line>
                    <ind-sys:text>cpe:/o:fedoraproject:fedora:35</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:rpminfo_item id="10009225" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10009224" status="exists">
                    <lin-sys:name>fedora-release-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10009223" status="exists">
                    <lin-sys:name>fedora-release-identity-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:family_item id="10009222" status="exists">
                    <ind-sys:family>unix</ind-sys:family>
                  </ind-sys:family_item>
                  <unix-sys:symlink_item id="10009221" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/back-ends/krb5.config</unix-sys:filepath>
                    <unix-sys:canonical_path>/usr/share/crypto-policies/DEFAULT/krb5.txt</unix-sys:canonical_path>
                  </unix-sys:symlink_item>
                  <ind-sys:variable_item id="10009220" status="exists">
                    <ind-sys:var_ref>oval:ssg-var_symlink_kerberos_crypto_policy_configuration:var:1</ind-sys:var_ref>
                    <ind-sys:value>/usr/share/crypto-policies/DEFAULT/krb5.txt</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:symlink_item id="10009219" status="exists">
                    <unix-sys:filepath>/etc/krb5.conf.d/crypto-policies</unix-sys:filepath>
                    <unix-sys:canonical_path>/usr/share/crypto-policies/DEFAULT/krb5.txt</unix-sys:canonical_path>
                  </unix-sys:symlink_item>
                  <unix-sys:file_item id="10009218" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/back-ends/nss.config</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies/back-ends</unix-sys:path>
                    <unix-sys:filename>nss.config</unix-sys:filename>
                    <unix-sys:type>symbolic link</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1637822935</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640175981</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1637822935</unix-sys:m_time>
                    <unix-sys:size datatype="int">42</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">true</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">true</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">true</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">true</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">true</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <unix-sys:file_item id="10009217" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/state/current</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies/state</unix-sys:path>
                    <unix-sys:filename>current</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1637822935</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640175981</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1637822935</unix-sys:m_time>
                    <unix-sys:size datatype="int">8</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:variable_item id="10009216" status="exists">
                    <ind-sys:var_ref>oval:ssg-variable_crypto_policies_config_file_timestamp:var:1</ind-sys:var_ref>
                    <ind-sys:value>1637822935</ind-sys:value>
                  </ind-sys:variable_item>
                  <unix-sys:file_item id="10009215" status="exists">
                    <unix-sys:filepath>/etc/crypto-policies/config</unix-sys:filepath>
                    <unix-sys:path>/etc/crypto-policies</unix-sys:path>
                    <unix-sys:filename>config</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1637822935</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640175981</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1637822935</unix-sys:m_time>
                    <unix-sys:size datatype="int">8</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10009214" status="exists">
                    <ind-sys:filepath>/etc/crypto-policies/state/current</ind-sys:filepath>
                    <ind-sys:path>/etc/crypto-policies/state</ind-sys:path>
                    <ind-sys:filename>current</ind-sys:filename>
                    <ind-sys:pattern>^(?!#)(\S+)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(?!#)(\S+)$</ind-sys:line>
                    <ind-sys:text>DEFAULT</ind-sys:text>
                    <ind-sys:subexpression>DEFAULT</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                  <ind-sys:textfilecontent_item id="10009213" status="exists">
                    <ind-sys:filepath>/etc/crypto-policies/config</ind-sys:filepath>
                    <ind-sys:path>/etc/crypto-policies</ind-sys:path>
                    <ind-sys:filename>config</ind-sys:filename>
                    <ind-sys:pattern>^(?!#)(\S+)$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^(?!#)(\S+)$</ind-sys:line>
                    <ind-sys:text>DEFAULT</ind-sys:text>
                    <ind-sys:subexpression>DEFAULT</ind-sys:subexpression>
                  </ind-sys:textfilecontent_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
    <arf:report id="oval1">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
            <oval:product_version>1.3.5</oval:product_version>
            <oval:schema_version>5.11</oval:schema_version>
            <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
              <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
              <oval:schema_version>5.11</oval:schema_version>
              <oval:timestamp>2021-09-30T00:00:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:uefi"/>
                  <description>Check if system boot mode is UEFI.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" comment="check if /sys/firmware/efi folder exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-system_boot_mode_is_non_uefi:def:1" version="1" class="inventory">
                <metadata>
                  <title>Non-UEFI system boot mode check</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:non-uefi"/>
                  <description>Check if System boot mode is non-UEFI.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" negate="true" comment="Pass if System boot mode is non-UEFI"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-sssd_conf_uses_ldap:def:1" version="1" class="inventory">
                <metadata>
                  <title>SSSD is configured to use LDAP</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd-ldap"/>
                  <description>Identification provider is not set to ad within /etc/sssd/sssd.conf</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" negate="true" comment="Identification provider is not set to ad within /etc/sssd/sssd.conf"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test that the architecture is s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is s390x</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" comment="Architecture is s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" version="1" class="inventory">
                <metadata>
                  <title>Test for different architecture than s390x</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>Check that architecture of kernel in /proc/sys/kernel/osrelease is not s390x</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" negate="true" comment="Architecture is not s390x"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_machine:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a machine</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:machine"/>
                  <description>Check for absence of files characterizing container filesystems.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" negate="true" comment="If environment is not a container, it is machine"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_is_a_container:def:1" version="2" class="inventory">
                <metadata>
                  <title>Check if the scan target is a container</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:container"/>
                  <description>Check for presence of files characterizing container filesystems.</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" comment="Check if /.dockerenv exists"/>
                  <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" comment="Check if /run/.containerenv exists"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_zipl_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>System uses zIPL</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:zipl"/>
                  <description>Checks if system uses zIPL bootloader.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" comment="Package s390utils-base is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_yum_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package yum is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:yum"/>
                  <description>Checks if package yum is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" comment="Package yum is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_systemd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package systemd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:systemd"/>
                  <description>Checks if package systemd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" comment="Package systemd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sudo_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sudo is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sudo"/>
                  <description>Checks if package sudo is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" comment="Package sudo is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_sssd-common_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package sssd-common is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:sssd"/>
                  <description>Checks if package sssd-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" comment="Package sssd-common is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_postfix_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package postfix is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:postfix"/>
                  <description>Checks if package postfix is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" comment="Package postfix is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_pam_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package pam is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:pam"/>
                  <description>Checks if package pam is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" comment="Package pam is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_ntp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package ntp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:ntp"/>
                  <description>Checks if package ntp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" comment="Package ntp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package nss-pam-ldapd is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:nss-pam-ldapd"/>
                  <description>Checks if package nss-pam-ldapd is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" comment="Package nss-pam-ldapd is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_net-snmp_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package net-snmp is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:net-snmp"/>
                  <description>Checks if package net-snmp is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" comment="Package net-snmp is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_login_defs:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package providing /etc/login.defs is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:login_defs"/>
                  <description>Checks if package providing /etc/login.defs and is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" comment="Package providing /etc/login.defs is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_libuser_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package libuser is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:libuser"/>
                  <description>Checks if package libuser is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" comment="Package libuser is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_grub2_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package grub2 is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:grub2"/>
                  <description>Checks if package grub2-common is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" comment="Package grub2-common is installed"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" negate="true" comment="Test for ppcle64 architecture"/>
                    <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" negate="true" comment="Test if OPAL is not used"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_gdm_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package gdm is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:gdm"/>
                  <description>Checks if package gdm is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" comment="Package gdm is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_chrony_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package chrony is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:chrony"/>
                  <description>Checks if package chrony is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" comment="Package chrony is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_env_has_audit_package:def:1" version="1" class="inventory">
                <metadata>
                  <title>Package audit is installed</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:audit"/>
                  <description>Checks if package audit is installed.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" comment="Package audit is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:virtualization:4"/>
                  <description>The application installed installed on the system is
      Red Hat Virtualization 4.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" comment="Red Hat Virtualization Manager (RHVM)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhosp13:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat OpenStack Platform</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:openstack:13.0"/>
                  <description>The application installed installed on the system is
      Red Hat OpenStack Platform 13.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhosp13_release:tst:1" comment="OpenStack is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_app_is_rhosp10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat OpenStack Platform</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/a:redhat:openstack:10"/>
                  <description>The application installed installed on the system is
      Red Hat OpenStack Platform 10.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" comment="RHEL7 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhosp10_release:tst:1" comment="OpenStack is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux8:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is
      Wind River Linux 8</description>
                </metadata>
                <criteria comment="current WRLinux version is WRLinux8">
                  <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" comment="WRLinux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_wrlinux1019:def:1" version="1" class="inventory">
                <metadata>
                  <title>WRLinux 1019</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is
      Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" comment="Produce name is WRLinux"/>
                  <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" comment="WRLinux version is 1019"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed is an Ubuntu System</description>
                </metadata>
                <criteria comment="System is Ubuntu">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_lsb:tst:1" comment="lsb-based distrib"/>
                  <criterion test_ref="oval:ssg-test_ubuntu:tst:1" comment="Ubuntu is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu2004:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 2004</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:20.04"/>
                  <description>The operating system installed on the system is Ubuntu 2004</description>
                </metadata>
                <criteria comment="current Ubuntu version is Focal">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" comment="Focal is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1804:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1804</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:18.04"/>
                  <description>The operating system installed on the system is Ubuntu 1804</description>
                </metadata>
                <criteria comment="current Ubuntu version is Bionic">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" comment="Bionic is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1" class="inventory">
                <metadata>
                  <title>Ubuntu 1604</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:canonical:ubuntu_linux:16.04"/>
                  <description>The operating system installed on the system is Ubuntu 1604</description>
                </metadata>
                <criteria comment="current Ubuntu version is Xenial">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" comment="Ubuntu is installed"/>
                  <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" comment="Xenial is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle15:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:15"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:15"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 15.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" comment="SLE 15 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle15_server:tst:1" comment="SLE 15 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" comment="SLES 15 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sle12:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 12</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:12"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:12"/>
                  <description>The operating system installed on the system is
      SUSE Linux Enterprise 12.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" comment="SLE 12 Desktop is installed"/>
                    <criterion test_ref="oval:ssg-test_sle12_server:tst:1" comment="SLE 12 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" comment="SLES 12 for SAP Applications is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl7:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <description>The operating system installed on the system is
      Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl7:tst:1" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_sl6:def:1" version="2" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <description>The operating system installed on the system is
      Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_sl6:tst:1" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhv4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Virtualization 4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:virtualization:4"/>
                  <description>The operating system installed on the system is
      Red Hat Virtualization Host 4.4+ or Red Hat Enterprise Host.</description>
                </metadata>
                <criteria operator="OR">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" comment="RHEL8 OS installed"/>
                  <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:9"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel9:tst:1" comment="RHEL 9 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 9"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_9:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.9"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.9</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" comment="RHEL 8.9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" comment="RHEL 8.8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" comment="RHEL 8.7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_6:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" comment="RHEL 8.6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_5:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.5</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" comment="RHEL 8.5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.4</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.4"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" comment="RHEL 8.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_3:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.3</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.3"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" comment="RHEL 8.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_2:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.2</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.2"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" comment="RHEL 8.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_1:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.1</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.1"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" comment="RHEL 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_10:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.10"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" comment="RHEL 8.10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8_0:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8.0</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8.0"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" comment="RHEL 8.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel8:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel8:tst:1" comment="RHEL 8 is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 8"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhel7:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" comment="RHEL 7 Client is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" comment="RHEL 7 Workstation is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" comment="RHEL 7 Server is installed"/>
                    <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" comment="RHEL 7 Compute Node is installed"/>
                    <criteria comment="Red Hat Enterprise Virtualization Host is installed">
                      <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" comment="Red Hat Virtualization Host (RHVH)"/>
                      <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" comment="Red Hat Enterprise Virtualization Host is based on RHEL 7"/>
                    </criteria>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_rhcos4:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux CoreOS</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux_coreos:4"/>
                  <description>The operating system installed on the system is
      Red Hat Enterprise Linux CoreOS release 4</description>
                </metadata>
                <criteria>
                  <criteria>
                    <criterion test_ref="oval:ssg-test_rhcos:tst:1" comment="RHCOS is installed"/>
                    <criterion test_ref="oval:ssg-test_rhcos4:tst:1" comment="RHCOS version 4 is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Installed operating system is part of the Unix family</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed on the system is part of the Unix OS family</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:ssg-test_unix_family:tst:1" comment="Installed operating system is part of the unix family"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" comment="openSUSE Leap 42 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" comment="openSUSE is installed"/>
                  <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" comment="openSUSE Leap 15 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed on the system is openSUSE.</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol8_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <description>The operating system installed on the system is
      Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol8_system:tst:1" comment="Oracle Linux 8 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_ol7_family:def:1" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <description>The operating system installed on the system is
      Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:ssg-test_ol7_system:tst:1" comment="Oracle Linux 7 System is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_fedora:def:1" version="3" class="inventory">
                <metadata>
                  <title>Installed operating system is Fedora</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <description>The operating system installed on the system is Fedora</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" comment="fedora-release RPM packages are installed"/>
                  <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" comment="CPE vendor is 'fedoraproject' and product is 'fedora'"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian:def:1" version="1" class="inventory">
                <metadata>
                  <title>Debian</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <description>The operating system installed is a Debian System</description>
                </metadata>
                <criteria comment="System is Debian">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_debian:tst:1" comment="Debian is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian9:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian 9</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:9"/>
                  <description>The operating system installed on the system is Debian 9</description>
                </metadata>
                <criteria comment="current Debian version is Debian Stretch">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_9:tst:1" comment="Debian9 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_debian10:def:1" version="3" class="inventory">
                <metadata>
                  <title>Debian Linux 10</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:debian:debian_linux:10"/>
                  <description>The operating system installed on the system is Debian 10</description>
                </metadata>
                <criteria comment="Debian Linux is version 10">
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" comment="Debian is installed"/>
                  <criterion test_ref="oval:ssg-test_debian_10:tst:1" comment="Debian10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos8:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 8</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <description>The operating system installed on the system is
      CentOS 8</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos8_name:tst:1" comment="OS is CentOS"/>
                  <criterion test_ref="oval:ssg-test_centos8_version:tst:1" comment="OS version is 8"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos7:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 7</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <description>The operating system installed on the system is
      CentOS 7</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos7:tst:1" comment="CentOS7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:ssg-installed_OS_is_centos6:def:1" version="2" class="inventory">
                <metadata>
                  <title>CentOS 6</title>
                  <affected family="unix">
                    <platform>Fedora</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <description>The operating system installed on the system is
      CentOS 6</description>
                </metadata>
                <criteria>
                  <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" comment="Installed OS is part of the Unix family"/>
                  <criterion test_ref="oval:ssg-test_centos6:tst:1" comment="CentOS6 is installed"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" comment="Check WRLinux8 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux8:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_version_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" comment="Check WRLinux10.19 version">
                <ind-def:object object_ref="oval:ssg-obj_name_wrlinux1019:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux8:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_unix_wrlinux1019:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_wrlinux1019:ste:1"/>
              </ind-def:family_test>
              <ind-def:family_test id="oval:ssg-test_unix_family:tst:1" version="1" check="all" comment="Test installed OS is part of the unix family">
                <ind-def:object object_ref="oval:ssg-object_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_unix_family:ste:1"/>
              </ind-def:family_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_xenial:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_focal:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" comment="Check Ubuntu version">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu_bionic:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" comment="Check Ubuntu">
                <ind-def:object object_ref="oval:ssg-obj_ubuntu:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /sys/firmware/opal exists">
                <unix-def:object object_ref="oval:ssg-object_system_using_opal:obj:1"/>
              </unix-def:file_test>
              <unix-def:uname_test id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" comment="64 bit architecture">
                <unix-def:object object_ref="oval:ssg-object_system_info_architecture_ppcle_64:obj:1"/>
                <unix-def:state state_ref="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"/>
              </unix-def:uname_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sles_15_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_15_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" comment="SLES_SAP-release is version 12">
                <lin-def:object object_ref="oval:ssg-obj_sles_12_for_sap:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sles_12_for_sap:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle15_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle15_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" comment="sles-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" comment="sled-release is version 15">
                <lin-def:object object_ref="oval:ssg-obj_sle15_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle15_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_sle12_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_sle12_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" comment="sles-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" comment="sled-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sle12_desktop:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sle12_desktop:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl7:tst:1" version="1" check="all" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_sl7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_sl6:tst:1" version="1" check="all" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_sl6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_sl6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhvh4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhvh4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhosp13_release:tst:1" version="1" check="all" comment="OpenStack is version 13">
                <lin-def:object object_ref="oval:ssg-obj_rhosp13_release:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhosp13_release:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhosp10_release:tst:1" version="1" check="all" comment="OpenStack is version 10">
                <lin-def:object object_ref="oval:ssg-obj_rhosp10_release:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhosp10_release:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" comment="rhevm4-appliance is installed">
                <lin-def:object object_ref="oval:ssg-obj_rhevm4_version:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhevm4_version:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 9">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel9_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel9_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 8">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel8_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel8_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:ssg-obj_rhevh_rhel7_version:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhevh_rhel7_version:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel9_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel9_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel9:tst:1" version="1" check="all" comment="redhat-release is version 9">
                <lin-def:object object_ref="oval:ssg-obj_rhel9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel9:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel8_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel8_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" comment="redhat-release is version 8.9">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_9:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_9:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" comment="redhat-release is version 8.8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" comment="redhat-release is version 8.7">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" comment="redhat-release is version 8.6">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_6:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" comment="redhat-release is version 8.5">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_5:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_5:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" comment="redhat-release is version 8.4">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_4:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_4:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" comment="redhat-release is version 8.3">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_3:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_3:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" comment="redhat-release is version 8.2">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_2:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_2:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" comment="redhat-release is version 8.1">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_1:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_1:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" comment="redhat-release is version 8.10">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_10:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_10:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" comment="redhat-release is version 8.0">
                <lin-def:object object_ref="oval:ssg-obj_rhel8_0:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8_0:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel8:tst:1" version="1" check="all" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_rhel8:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel8:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" comment="redhat-release-workstation is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_workstation:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_workstation:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" comment="installed OS part of unix family">
                <ind-def:object object_ref="oval:ssg-obj_rhel7_unix_family:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhel7_unix_family:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" comment="redhat-release-server is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_server:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_server:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" comment="redhat-release-computenode is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_computenode:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_computenode:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" comment="redhat-release-client is version 7">
                <lin-def:object object_ref="oval:ssg-obj_rhel7_client:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_rhel7_client:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos:tst:1" version="1" check="all" comment="os-release is rhcos">
                <ind-def:object object_ref="oval:ssg-obj_rhcos:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" comment="rhcoreos is version 4">
                <ind-def:object object_ref="oval:ssg-obj_rhcos4:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_rhcos4:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" comment="proc_sys_kernel is for s390x architecture">
                <ind-def:object object_ref="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" comment="openSUSE Leap 42 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap42_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap42_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" comment="openSUSE Leap 15 is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_leap15_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_leap15_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" comment="openSUSE is installed">
                <lin-def:object object_ref="oval:ssg-obj_opensuse_installed:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_opensuse_installed:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:ssg-obj_ol8_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol8_system:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_ol7_system:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_ol7_system:ste:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/lsb-release exists">
                <unix-def:object object_ref="oval:ssg-obj_lsb:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /run/.containerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_podman_container:obj:1"/>
              </unix-def:file_test>
              <unix-def:file_test id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" comment="Check if /.dockerenv exists">
                <unix-def:object object_ref="oval:ssg-object_installed_env_is_a_docker_container:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" comment="SSSD Configuration is set to use Active Directory">
                <ind-def:object object_ref="oval:ssg-object_id_provider_is_set_to_ad:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" comment="CPE vendor is 'fedoraproject' and 'product' is fedora">
                <ind-def:object object_ref="oval:ssg-object_fedora_vendor_product:obj:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" comment="fedora-release RPM packages are installed">
                <lin-def:object object_ref="oval:ssg-object_fedora_release_rpm:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" comment="system has package zipl installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_zipl_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" comment="system has package yum installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_yum_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" comment="system has package systemd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_systemd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" comment="system has package sudo installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sudo_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" comment="system has package sssd-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_sssd-common_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package postfix is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_postfix_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" comment="system has package pam installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_pam_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package ntp is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_ntp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" comment="system has package nss-pam-ldapd installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" comment="system has package net-snmp installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_net-snmp_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" comment="system has package shadow-utils installed, which provides the /etc/login.defs file.">
                <lin-def:object object_ref="oval:ssg-obj_env_has_login_defs_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" comment="system has package libuser installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_libuser_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" comment="system has package grub2-common installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_grub2_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" comment="system has package gdm installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_gdm_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" comment="package chrony is installed">
                <lin-def:object object_ref="oval:ssg-obj_test_env_has_chrony_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" comment="system has package audit installed">
                <lin-def:object object_ref="oval:ssg-obj_env_has_audit_installed:obj:1"/>
              </lin-def:rpminfo_test>
              <unix-def:file_test id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" comment="Verify if /sys/firmware/efi folder exists">
                <unix-def:object object_ref="oval:ssg-object_file_sys_firmware_efi:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_9:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_9:obj:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_debian_10:tst:1" version="1" check="all" comment="Check Debian version">
                <ind-def:object object_ref="oval:ssg-obj_debian_10:obj:1"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" comment="/etc/debian_version exists">
                <unix-def:object object_ref="oval:ssg-obj_debian:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" comment="Check os-release VERSION_ID">
                <ind-def:object object_ref="oval:ssg-obj_version_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_version_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" comment="Check os-release ID">
                <ind-def:object object_ref="oval:ssg-obj_name_centos8:obj:1"/>
                <ind-def:state state_ref="oval:ssg-state_name_centos8:ste:1"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos7:tst:1" version="1" check="all" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:ssg-obj_centos7:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos7:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:ssg-test_centos6:tst:1" version="1" check="all" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:ssg-obj_centos6:obj:1"/>
                <lin-def:state state_ref="oval:ssg-state_centos6:ste:1"/>
              </lin-def:rpminfo_test>
            </tests>
            <objects>
              <ind-def:family_object id="oval:ssg-object_unix_family:obj:1" version="1"/>
              <unix-def:file_object id="oval:ssg-object_system_using_opal:obj:1" version="1">
                <unix-def:filepath>/sys/firmware/opal</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:uname_object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" comment="64 bit architecture"/>
              <ind-def:textfilecontent54_object id="oval:ssg-object_proc_sys_kernel_osrelease_arch_s390x:obj:1" version="1">
                <ind-def:filepath>/proc/sys/kernel/osrelease</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^.*\.(.*)$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" comment="Check file /run/.containerenv">
                <unix-def:filepath>/run/.containerenv</unix-def:filepath>
              </unix-def:file_object>
              <unix-def:file_object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" comment="Check file /.dockerenv">
                <unix-def:filepath>/.dockerenv</unix-def:filepath>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_id_provider_is_set_to_ad:obj:1" version="1">
                <ind-def:filepath>/etc/sssd/sssd.conf</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^[\s]*\[domain\/[^]]*]([^\n\[\]]*\n+)+?[\s]*id_provider[ \t]*=[ \t]*((?i)ad)[ \t]*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-object_file_sys_firmware_efi:obj:1" version="1" comment="/sys/firmware/efi">
                <unix-def:path>/sys/firmware/efi</unix-def:path>
                <unix-def:filename xsi:nil="true"/>
              </unix-def:file_object>
              <ind-def:textfilecontent54_object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1">
                <ind-def:filepath>/etc/system-release-cpe</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1">
                <lin-def:name operation="pattern match">fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux8:obj:1" version="1" comment="Check WRLinux8 version">
                <ind-def:filepath>/etc/wrlinux-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.8\.0.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 version">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION=.10\.19.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_version_centos8:obj:1" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux8:obj:1" version="1"/>
              <ind-def:family_object id="oval:ssg-obj_unix_wrlinux1019:obj:1" version="1"/>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_xenial:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=xenial$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_focal:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=focal$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu_bionic:obj:1" version="1" comment="Check Ubuntu version">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_CODENAME=bionic$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_ubuntu:obj:1" version="1" comment="Check Ubuntu">
                <ind-def:filepath>/etc/lsb-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^DISTRIB_ID=Ubuntu$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_postfix_installed:obj:1" version="1">
                <lin-def:name>postfix</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_ntp_installed:obj:1" version="1">
                <lin-def:name>ntp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_test_env_has_chrony_installed:obj:1" version="1">
                <lin-def:name>chrony</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_15_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sles_12_for_sap:obj:1" version="1">
                <lin-def:name>SLES_SAP-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle15_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle15_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_sle12_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_server:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sle12_desktop:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl7:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_sl6:obj:1" version="1">
                <lin-def:name>sl-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhvh4_version:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhosp13_release:obj:1" version="1">
                <lin-def:name>rhosp-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhosp10_release:obj:1" version="1">
                <lin-def:name>rhosp-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhevm4_version:obj:1" version="1">
                <lin-def:name>rhvm-appliance</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel9_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel8_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhevh_rhel7_version:obj:1" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:family_object id="oval:ssg-obj_rhel9_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel8_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_9:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_7:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_6:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_5:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_4:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_3:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_2:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_1:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_10:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8_0:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel8:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_workstation:obj:1" version="1">
                <lin-def:name>redhat-release-workstation</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:family_object id="oval:ssg-obj_rhel7_unix_family:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_server:obj:1" version="1">
                <lin-def:name>redhat-release-server</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_computenode:obj:1" version="1">
                <lin-def:name>redhat-release-computenode</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_rhel7_client:obj:1" version="1">
                <lin-def:name>redhat-release-client</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_rhcos4:obj:1" version="1">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)\.\d+"$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap42_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_leap15_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_opensuse_installed:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol8_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_ol7_system:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_wrlinux1019:obj:1" version="1" comment="Check WRLinux1019 produce name">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^NAME=.Wind[\s]+River[\s]+Linux.*$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_name_centos8:obj:1" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_lsb:obj:1" version="1" comment="check /etc/lsb-release file">
                <unix-def:filepath>/etc/lsb-release</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_zipl_installed:obj:1" version="1">
                <lin-def:name>s390utils-base</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1">
                <lin-def:name>yum</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_systemd_installed:obj:1" version="1">
                <lin-def:name>systemd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sudo_installed:obj:1" version="1">
                <lin-def:name>sudo</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1">
                <lin-def:name>sssd-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1">
                <lin-def:name>pam</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_nss-pam-ldapd_installed:obj:1" version="1">
                <lin-def:name>nss-pam-ldapd</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_net-snmp_installed:obj:1" version="1">
                <lin-def:name>net-snmp</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1">
                <lin-def:name>shadow-utils</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1">
                <lin-def:name>libuser</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1">
                <lin-def:name>grub2-common</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1">
                <lin-def:name>gdm</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_env_has_audit_installed:obj:1" version="1">
                <lin-def:name>audit</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_9:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^9.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:ssg-obj_debian_10:obj:1" version="1" comment="Check Debian version">
                <ind-def:filepath>/etc/debian_version</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^10.[0-9]+$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:ssg-obj_debian:obj:1" version="1" comment="check /etc/debian_version file">
                <unix-def:filepath>/etc/debian_version</unix-def:filepath>
              </unix-def:file_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos7:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:ssg-obj_centos6:obj:1" version="1">
                <lin-def:name>centos-release</lin-def:name>
              </lin-def:rpminfo_object>
            </objects>
            <states>
              <ind-def:textfilecontent54_state id="oval:ssg-state_version_centos8:ste:1" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux8:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_wrlinux1019:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <ind-def:family_state id="oval:ssg-state_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <unix-def:uname_state id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1" version="1" comment="64 bit architecture">
                <unix-def:processor_type>ppc64le</unix-def:processor_type>
              </unix-def:uname_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_15_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sles_12_for_sap:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle15_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle15_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_sle12_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sle12_desktop:ste:1" version="1">
                <lin-def:version operation="pattern match">^12.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_sl6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhvh4_version:ste:1" version="1">
                <lin-def:evr operation="greater than or equal" datatype="evr_string">0:4.4</lin-def:evr>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhosp13_release:ste:1" version="1">
                <lin-def:version operation="pattern match">^13.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhosp10_release:ste:1" version="1">
                <lin-def:version operation="pattern match">^10.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhevm4_version:ste:1" version="1">
                <lin-def:version operation="pattern match">^4.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel9_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">9</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel8_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhevh_rhel7_version:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:family_state id="oval:ssg-state_rhel9_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel9:ste:1" version="1">
                <lin-def:version operation="pattern match">^9.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel8_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_9:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.9*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.8*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_7:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.7*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_6:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.6*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_5:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.5*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_4:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.4*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_3:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.3*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_2:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.2*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_1:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.1*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_10:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.10*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8_0:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.0*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel8:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_workstation:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:family_state id="oval:ssg-state_rhel7_unix_family:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_server:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_computenode:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_rhel7_client:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">rhcos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_rhcos4:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">4</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_proc_sys_kernel_osrelease_arch_s390x:ste:1" version="1">
                <ind-def:subexpression operation="pattern match">^s390x$</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap42_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^42.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_leap15_installed:ste:1" version="1">
                <lin-def:version operation="pattern match">^15.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_opensuse_installed:ste:1" version="1">
                <lin-def:name operation="pattern match">openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol8_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^8.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_ol7_system:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:ssg-state_name_centos8:ste:1" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos7:ste:1" version="1">
                <lin-def:version operation="pattern match">^7.*$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:ssg-state_centos6:ste:1" version="1">
                <lin-def:version operation="pattern match">^6.*$</lin-def:version>
              </lin-def:rpminfo_state>
            </states>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:ssg-system_boot_mode_is_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_efi_dir_existence:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-system_boot_mode_is_non_uefi:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-system_boot_mode_is_uefi:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-sssd_conf_uses_ldap:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-proc_sys_kernel_osrelease_arch_not_s390x:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-proc_sys_kernel_osrelease_arch_s390x:def:1" version="1" result="not evaluated" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_machine:def:1" result="false" version="2">
                  <criteria operator="AND" result="false">
                    <extend_definition definition_ref="oval:ssg-installed_env_is_a_container:def:1" version="2" result="false" negate="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_is_a_container:def:1" result="true" version="2">
                  <criteria operator="OR" result="true">
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" result="false"/>
                    <criterion test_ref="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_zipl_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_yum_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_yum_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_systemd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sudo_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_sssd-common_package:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_postfix_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_pam_package:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_pam_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_ntp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_nss-pam-ldapd_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_net-snmp_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_login_defs:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_libuser_package:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_grub2_package:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" result="false"/>
                    <criteria operator="OR" result="true">
                      <criterion test_ref="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" result="true" negate="true"/>
                      <criterion test_ref="oval:ssg-test_system_using_opal:tst:1" version="1" result="true" negate="true"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_gdm_package:def:1" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_chrony_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_env_has_audit_package:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_env_has_audit_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhevm4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhosp13:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhosp13_release:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_app_is_rhosp10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel7:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhosp10_release:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux8:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_wrlinux1019:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_wrlinux1019_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_lsb:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu2004:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_focal:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1804:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_bionic:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ubuntu1604:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_ubuntu:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_ubuntu_xenial:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle15_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle15_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle15_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_15_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sle12:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_sle12_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_sle12_desktop:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sle12_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_sles_12_for_sap:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_sl6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_sl6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhv4:def:1" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_rhel8:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel9_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel9:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_9:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_8:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_6:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_5:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_5:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_4:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_3:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_3:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_2:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_2:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_1:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_1:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_10:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8_0:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_0:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel8:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel8_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel8:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhel7:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:ssg-test_rhel7_unix_family:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhel7_client:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_workstation:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_server:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhel7_computenode:tst:1" version="1" result="not evaluated"/>
                      <criteria operator="AND" result="not evaluated">
                        <criterion test_ref="oval:ssg-test_rhvh4_version:tst:1" version="1" result="not evaluated"/>
                        <criterion test_ref="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" result="not evaluated"/>
                      </criteria>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_rhcos4:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_rhcos:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:ssg-test_rhcos4:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:ssg-test_unix_family:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap42:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse_leap15:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_opensuse:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_opensuse_installed:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol8_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol8_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_ol7_family:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:ssg-test_ol7_system:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_fedora:def:1" result="true" version="3">
                  <criteria operator="AND" result="true">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_release_rpm:tst:1" version="1" result="true"/>
                    <criterion test_ref="oval:ssg-test_fedora_vendor_product:tst:1" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian9:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_9:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_debian10:def:1" result="not evaluated" version="3">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_debian:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_debian_10:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos8:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_name:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos8_version:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos7:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos7:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:ssg-installed_OS_is_centos6:def:1" result="not evaluated" version="2">
                  <criteria operator="AND" result="not evaluated">
                    <extend_definition definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:ssg-test_centos6:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:ssg-test_centos6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_centos8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_debian_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_efi_dir_existence:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_audit_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_chrony_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_gdm_installed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_env_has_grub2_installed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_env_has_libuser_installed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_env_has_login_defs_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009233" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_net-snmp_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_nss-pam-ldapd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_ntp_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_pam_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009230" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_postfix_installed:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_sssd-common_installed:tst:1" version="1" check="all" result="false"/>
                <test test_id="oval:ssg-test_env_has_sudo_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_systemd_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_env_has_yum_installed:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009228" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_env_has_zipl_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_fedora_release_rpm:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="1000929" result="not evaluated"/>
                  <tested_item item_id="1000928" result="not evaluated"/>
                  <tested_item item_id="10009210" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_fedora_vendor_product:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="10009211" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_id_provider_is_set_to_ad:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_installed_env_is_a_docker_container:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_installed_env_is_a_podman_container:tst:1" version="1" check_existence="all_exist" check="all" result="true">
                  <tested_item item_id="10009212" result="not evaluated"/>
                </test>
                <test test_id="oval:ssg-test_lsb:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol7_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ol8_system:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap15_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_opensuse_leap42_installed:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_proc_sys_kernel_osrelease_arch_s390x:tst:1" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhcos:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_client:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_computenode:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel7_workstation:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_0:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_10:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_1:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_2:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_3:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_4:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_5:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel8_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhel9_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel7_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel8_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevh_rhel9_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhevm4_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhosp10_release:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhosp13_release:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_rhvh4_version:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl6:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sl7:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle12_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_desktop:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_server:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sle15_unix_family:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_12_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_sles_15_for_sap:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_system_info_architecture_ppcle_64:tst:1" version="1" check="all" result="false">
                  <tested_item item_id="10009295" result="false"/>
                </test>
                <test test_id="oval:ssg-test_system_using_opal:tst:1" version="1" check_existence="all_exist" check="all" result="false"/>
                <test test_id="oval:ssg-test_ubuntu:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_bionic:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_focal:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_ubuntu_xenial:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_family:tst:1" version="1" check="all" result="true">
                  <tested_item item_id="1000927" result="true"/>
                </test>
                <test test_id="oval:ssg-test_unix_wrlinux1019:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_unix_wrlinux8:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_name:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux1019_version:tst:1" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:ssg-test_wrlinux8_version:tst:1" version="1" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>combine_ovals.py from SCAP Security Guide</oval:product_name>
                  <oval:product_version>ssg: [0, 1, 58], python: 3.10.0rc2</oval:product_version>
                  <oval:schema_version>5.11</oval:schema_version>
                  <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>35 (Container Image)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>e98bca166d82</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>10.0.2.100</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>fe80::a08a:71ff:fe1f:ac82</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:ssg-obj_env_has_gdm_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_env_has_grub2_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_env_has_libuser_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_env_has_login_defs_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10009233"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_pam_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10009230"/>
                  </object>
                  <object id="oval:ssg-obj_env_has_sssd-common_installed:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-obj_env_has_yum_installed:obj:1" version="1" flag="complete">
                    <reference item_ref="10009228"/>
                  </object>
                  <object id="oval:ssg-object_fedora_release_rpm:obj:1" version="1" flag="complete">
                    <reference item_ref="1000929"/>
                    <reference item_ref="1000928"/>
                    <reference item_ref="10009210"/>
                  </object>
                  <object id="oval:ssg-object_fedora_vendor_product:obj:1" version="1" flag="complete">
                    <reference item_ref="10009211"/>
                  </object>
                  <object id="oval:ssg-object_installed_env_is_a_docker_container:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_installed_env_is_a_podman_container:obj:1" version="1" flag="complete">
                    <reference item_ref="10009212"/>
                  </object>
                  <object id="oval:ssg-object_system_info_architecture_ppcle_64:obj:1" version="1" flag="complete">
                    <reference item_ref="10009295"/>
                  </object>
                  <object id="oval:ssg-object_system_using_opal:obj:1" version="1" flag="does not exist"/>
                  <object id="oval:ssg-object_unix_family:obj:1" version="1" flag="complete">
                    <reference item_ref="1000927"/>
                  </object>
                </collected_objects>
                <system_data>
                  <unix-sys:uname_item id="10009295" status="exists">
                    <unix-sys:machine_class>x86_64</unix-sys:machine_class>
                    <unix-sys:node_name>e98bca166d82</unix-sys:node_name>
                    <unix-sys:os_name>Linux</unix-sys:os_name>
                    <unix-sys:os_release>5.15.8-100.fc34.x86_64</unix-sys:os_release>
                    <unix-sys:os_version>#1 SMP Tue Dec 14 14:31:27 UTC 2021</unix-sys:os_version>
                    <unix-sys:processor_type>x86_64</unix-sys:processor_type>
                  </unix-sys:uname_item>
                  <lin-sys:rpminfo_item id="1000929" status="exists">
                    <lin-sys:name>fedora-release-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1000928" status="exists">
                    <lin-sys:name>fedora-release-identity-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <ind-sys:family_item id="1000927" status="exists">
                    <ind-sys:family>unix</ind-sys:family>
                  </ind-sys:family_item>
                  <lin-sys:rpminfo_item id="10009233" status="exists">
                    <lin-sys:name>shadow-utils</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>2</lin-sys:epoch>
                    <lin-sys:release>7.fc35</lin-sys:release>
                    <lin-sys:version>4.9</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">2:4.9-7.fc35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>shadow-utils-2:4.9-7.fc35.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10009230" status="exists">
                    <lin-sys:name>pam</lin-sys:name>
                    <lin-sys:arch>x86_64</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>5.fc35</lin-sys:release>
                    <lin-sys:version>1.5.2</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:1.5.2-5.fc35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>pam-0:1.5.2-5.fc35.x86_64</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="10009228" status="exists">
                    <lin-sys:name>yum</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>1.fc35</lin-sys:release>
                    <lin-sys:version>4.9.0</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:4.9.0-1.fc35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>yum-0:4.9.0-1.fc35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <unix-sys:file_item id="10009212" status="exists">
                    <unix-sys:filepath>/run/.containerenv</unix-sys:filepath>
                    <unix-sys:path>/run</unix-sys:path>
                    <unix-sys:filename>.containerenv</unix-sys:filename>
                    <unix-sys:type>regular</unix-sys:type>
                    <unix-sys:group_id datatype="int">0</unix-sys:group_id>
                    <unix-sys:user_id datatype="int">0</unix-sys:user_id>
                    <unix-sys:a_time datatype="int">1640190697</unix-sys:a_time>
                    <unix-sys:c_time datatype="int">1640190697</unix-sys:c_time>
                    <unix-sys:m_time datatype="int">1640190697</unix-sys:m_time>
                    <unix-sys:size datatype="int">0</unix-sys:size>
                    <unix-sys:suid datatype="boolean">false</unix-sys:suid>
                    <unix-sys:sgid datatype="boolean">false</unix-sys:sgid>
                    <unix-sys:sticky datatype="boolean">false</unix-sys:sticky>
                    <unix-sys:uread datatype="boolean">true</unix-sys:uread>
                    <unix-sys:uwrite datatype="boolean">true</unix-sys:uwrite>
                    <unix-sys:uexec datatype="boolean">false</unix-sys:uexec>
                    <unix-sys:gread datatype="boolean">true</unix-sys:gread>
                    <unix-sys:gwrite datatype="boolean">false</unix-sys:gwrite>
                    <unix-sys:gexec datatype="boolean">false</unix-sys:gexec>
                    <unix-sys:oread datatype="boolean">true</unix-sys:oread>
                    <unix-sys:owrite datatype="boolean">false</unix-sys:owrite>
                    <unix-sys:oexec datatype="boolean">false</unix-sys:oexec>
                    <unix-sys:has_extended_acl datatype="boolean">false</unix-sys:has_extended_acl>
                  </unix-sys:file_item>
                  <ind-sys:textfilecontent_item id="10009211" status="exists">
                    <ind-sys:filepath>/etc/system-release-cpe</ind-sys:filepath>
                    <ind-sys:path>/etc</ind-sys:path>
                    <ind-sys:filename>system-release-cpe</ind-sys:filename>
                    <ind-sys:pattern>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:pattern>
                    <ind-sys:instance datatype="int">1</ind-sys:instance>
                    <ind-sys:line>^cpe:\/o:fedoraproject:fedora:[\d]+$</ind-sys:line>
                    <ind-sys:text>cpe:/o:fedoraproject:fedora:35</ind-sys:text>
                  </ind-sys:textfilecontent_item>
                  <lin-sys:rpminfo_item id="10009210" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
    <arf:report id="oval2">
      <arf:content>
        <oval_results xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns="http://oval.mitre.org/XMLSchema/oval-results-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-results-5 oval-results-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
          <generator>
            <oval:product_name>vim</oval:product_name>
            <oval:product_version>1.3.5</oval:product_version>
            <oval:schema_version>5.10.1</oval:schema_version>
            <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
          </generator>
          <directives>
            <definition_true reported="true" content="full"/>
            <definition_false reported="true" content="full"/>
            <definition_unknown reported="true" content="full"/>
            <definition_error reported="true" content="full"/>
            <definition_not_evaluated reported="true" content="full"/>
            <definition_not_applicable reported="true" content="full"/>
          </directives>
          <oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:mac-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#macos" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#macos macos-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
            <generator>
              <oval:product_name>vim</oval:product_name>
              <oval:schema_version>5.10.1</oval:schema_version>
              <oval:timestamp>2012-11-22T15:00:00+01:00</oval:timestamp>
            </generator>
            <definitions>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:8" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux 8</title>
                  <affected family="unix">
                    <platform>Wind River Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux:8"/>
                  <description>The operating system installed on the system is Wind River Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" comment="Wind River Linux version is 8."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:1019" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux 1019</title>
                  <affected family="unix">
                    <platform>Wind River Linux 1019</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux:1019"/>
                  <description>The operating system installed on the system is Wind River Linux 1019</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1019" comment="Wind River Linux version is 1019."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.wrlinux:def:1" version="1" class="inventory">
                <metadata>
                  <title>Wind River Linux</title>
                  <affected family="unix">
                    <platform>Wind River Linux</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:windriver:wrlinux"/>
                  <description>The operating system installed on the system is Wind River Linux</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1" comment="Installed operating system is part of the unix family."/>
                  <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:2" comment="Wind River Linux is installed."/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:81" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 8.1</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 8.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_8.1"/>
                  <description>The operating system installed on the system is Microsoft Windows 8.1</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:81" comment="Microsoft Windows 8.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:8" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 8</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_8"/>
                  <description>The operating system installed on the system is Microsoft Windows 8</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:8" comment="Microsoft Windows 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:7" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 7</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_7"/>
                  <description>The operating system installed on the system is Microsoft Windows 7</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:7" comment="Microsoft Windows 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2016" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2016</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2016</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2016"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2016</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2016" comment="Microsoft Windows Server 2016 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2012" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2012</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2012</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2012"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2012</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2012" comment="Microsoft Windows Server 2012 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:2008" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows Server 2008</title>
                  <affected family="windows">
                    <platform>Microsoft Windows Server 2008</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2008"/>
                  <description>The operating system installed on the system is Microsoft Windows Server 2008</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2008" comment="Microsoft Windows Server 2008 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.windows:def:10" version="1" class="inventory">
                <metadata>
                  <title>Microsoft Windows 10</title>
                  <affected family="windows">
                    <platform>Microsoft Windows 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:microsoft:windows_10"/>
                  <description>The operating system installed on the system is Microsoft Windows 10</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.windows:tst:10" comment="Microsoft Windows 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sles:def:12" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Server 12</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 12</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sles:12"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Server 12</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sles:tst:12" comment="SLES 12 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sles:def:10" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Server 10</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sles:10"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Server 10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sles:tst:10" comment="SLES 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sled:def:12" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Desktop 12</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Desktop 12</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sled:12"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Desktop 12</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sled:tst:12" comment="SLED 12 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sled:def:10" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise Desktop 10</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Desktop 10</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sled:10"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise Desktop 10</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sled:tst:10" comment="SLED 10 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sle:def:11" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise 11</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise Server 11</platform>
                    <platform>SUSE Linux Enterprise Desktop 11</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_server:11"/>
                  <reference source="CPE" ref_id="cpe:/o:suse:linux_enterprise_desktop:11"/>
                  <reference source="galford" ref_id="20160920" ref_url="test_attestation"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise 11.</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.sle:tst:1" comment="Installed operating system is part of the unix family"/>
                  <criteria operator="OR">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:11" comment="SLE 11 Desktop is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:11" comment="SLE 11 Server is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.sle:def:1" version="1" class="inventory">
                <metadata>
                  <title>SUSE Linux Enterprise All Platforms</title>
                  <affected family="unix">
                    <platform>SUSE Linux Enterprise All Platforms</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:suse:sle"/>
                  <description>The operating system installed on the system is SUSE Linux Enterprise</description>
                </metadata>
                <criteria>
                  <criteria operator="OR">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:1" comment="SLES is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:1" comment="SLED is installed"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:7" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 7</title>
                  <affected family="unix">
                    <platform>Scientific Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:7"/>
                  <description>The operating system installed on the system is Scientific Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:7" comment="Scientific Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:6" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 6</title>
                  <affected family="unix">
                    <platform>Scientific Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:6"/>
                  <description>The operating system installed on the system is Scientific Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:6" comment="Scientific Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.scientific:def:5" version="1" class="inventory">
                <metadata>
                  <title>Scientific Linux 5</title>
                  <affected family="unix">
                    <platform>Scientific Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:scientificlinux:scientificlinux:5"/>
                  <description>The operating system installed on the system is Scientific Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:5" comment="Scientific Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:8" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 8</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:8"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:8" comment="Red Hat Enterprise Linux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:7" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 7</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:7"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 7</description>
                </metadata>
                <criteria operator="OR">
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:7" comment="Red Hat Enterprise Linux 7 is installed"/>
                  <criteria comment="Red Hat Enterpise Virtualization Host is installed">
                    <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:1" comment="redhat-release-virtualization-host RPM package is installed"/>
                    <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:2" comment="Red Hat Enterpise Virtualization Host is based on RHEL 7"/>
                  </criteria>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:6" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 6</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:6"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:6" comment="Red Hat Enterprise Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:5" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux 5</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux:5"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:5" comment="Red Hat Enterprise Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1007" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 7</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:7"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1007" comment="Community Enterprise Operating System 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1006" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 6</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:6"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1006" comment="Community Enterprise Operating System 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1005" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 5</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:5"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1005" comment="Community Enterprise Operating System 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.rhel:def:1" version="1" class="inventory">
                <metadata>
                  <title>Red Hat Enterprise Linux</title>
                  <affected family="unix">
                    <platform>Red Hat Enterprise Linux</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:redhat:enterprise_linux"/>
                  <description>The operating system installed on the system is Red Hat Enterprise Linux</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:2" comment="Red Hat Enterprise Linux is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:423" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.3</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.3</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.3"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.3</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:423" comment="openSUSE Leap 42.3 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:422" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.2</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.2</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:novell:leap:42.2"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.2"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:422" comment="openSUSE Leap 42.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:421" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 42.1</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 42.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:novell:leap:42.1"/>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:42.1"/>
                  <description>The operating system installed on the system is openSUSE Leap 42.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:421" comment="openSUSE Leap 42.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:150" version="1" class="inventory">
                <metadata>
                  <title>openSUSE Leap 15.0</title>
                  <affected family="unix">
                    <platform>openSUSE Leap 15.0</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:leap:15.0"/>
                  <description>The operating system installed on the system is openSUSE Leap 15.0</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:150" comment="openSUSE Leap 15.0 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:132" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 13.2</title>
                  <affected family="unix">
                    <platform>openSUSE 13.2</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:13.2"/>
                  <description>The operating system installed on the system is openSUSE 13.2</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:132" comment="openSUSE 13.2 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:131" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 13.1</title>
                  <affected family="unix">
                    <platform>openSUSE 13.1</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:13.1"/>
                  <description>The operating system installed on the system is openSUSE 13.1</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:131" comment="openSUSE 13.1 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:114" version="1" class="inventory">
                <metadata>
                  <title>openSUSE 11.4</title>
                  <affected family="unix">
                    <platform>openSUSE 11.4</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse:11.4"/>
                  <description>The operating system installed on the system is openSUSE 11.4</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:114" comment="openSUSE 11.4 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.opensuse:def:1" version="1" class="inventory">
                <metadata>
                  <title>openSUSE All Versions</title>
                  <affected family="unix">
                    <platform>openSUSE</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:opensuse:opensuse"/>
                  <description>The operating system installed on the system is openSUSE</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:1" comment="openSUSE is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:8" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 8</title>
                  <affected family="unix">
                    <platform>Oracle Linux 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:8"/>
                  <description>The operating system installed on the system is Oracle Linux 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:8" comment="Oracle Linux 8 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:7" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 7</title>
                  <affected family="unix">
                    <platform>Oracle Linux 7</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:7"/>
                  <description>The operating system installed on the system is Oracle Linux 7</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:7" comment="Oracle Linux 7 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:6" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 6</title>
                  <affected family="unix">
                    <platform>Oracle Linux 6</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:6"/>
                  <description>The operating system installed on the system is Oracle Linux 6</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:6" comment="Oracle Linux 6 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.ol:def:5" version="1" class="inventory">
                <metadata>
                  <title>Oracle Linux 5</title>
                  <affected family="unix">
                    <platform>Oracle Linux 5</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:oracle:linux:5"/>
                  <description>The operating system installed on the system is Oracle Linux 5</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.ol:tst:5" comment="Oracle Linux 5 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:35" version="1" class="inventory">
                <metadata>
                  <title>Fedora 35</title>
                  <affected family="unix">
                    <platform>Fedora 35</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:35"/>
                  <description>The operating system installed on the system is Fedora 35</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:35" comment="Fedora 35 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:34" version="1" class="inventory">
                <metadata>
                  <title>Fedora 34</title>
                  <affected family="unix">
                    <platform>Fedora 34</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:34"/>
                  <description>The operating system installed on the system is Fedora 34</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:34" comment="Fedora 34 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:33" version="1" class="inventory">
                <metadata>
                  <title>Fedora 33</title>
                  <affected family="unix">
                    <platform>Fedora 33</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:33"/>
                  <description>The operating system installed on the system is Fedora 33</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:33" comment="Fedora 33 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:32" version="1" class="inventory">
                <metadata>
                  <title>Fedora 32</title>
                  <affected family="unix">
                    <platform>Fedora 32</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:32"/>
                  <description>The operating system installed on the system is Fedora 32</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:32" comment="Fedora 32 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:31" version="1" class="inventory">
                <metadata>
                  <title>Fedora 31</title>
                  <affected family="unix">
                    <platform>Fedora 31</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:31"/>
                  <description>The operating system installed on the system is Fedora 31</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:31" comment="Fedora 31 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:30" version="1" class="inventory">
                <metadata>
                  <title>Fedora 30</title>
                  <affected family="unix">
                    <platform>Fedora 30</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:30"/>
                  <description>The operating system installed on the system is Fedora 30</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:30" comment="Fedora 30 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:29" version="1" class="inventory">
                <metadata>
                  <title>Fedora 29</title>
                  <affected family="unix">
                    <platform>Fedora 29</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:29"/>
                  <description>The operating system installed on the system is Fedora 29</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:29" comment="Fedora 29 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:28" version="1" class="inventory">
                <metadata>
                  <title>Fedora 28</title>
                  <affected family="unix">
                    <platform>Fedora 28</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:28"/>
                  <description>The operating system installed on the system is Fedora 28</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:28" comment="Fedora 28 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:27" version="1" class="inventory">
                <metadata>
                  <title>Fedora 27</title>
                  <affected family="unix">
                    <platform>Fedora 27</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:27"/>
                  <description>The operating system installed on the system is Fedora 27</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:27" comment="Fedora 27 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:26" version="1" class="inventory">
                <metadata>
                  <title>Fedora 26</title>
                  <affected family="unix">
                    <platform>Fedora 26</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:26"/>
                  <description>The operating system installed on the system is Fedora 26</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:26" comment="Fedora 26 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:25" version="1" class="inventory">
                <metadata>
                  <title>Fedora 25</title>
                  <affected family="unix">
                    <platform>Fedora 25</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:25"/>
                  <description>The operating system installed on the system is Fedora 25</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:25" comment="Fedora 25 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:24" version="1" class="inventory">
                <metadata>
                  <title>Fedora 24</title>
                  <affected family="unix">
                    <platform>Fedora 24</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:24"/>
                  <description>The operating system installed on the system is Fedora 24</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:24" comment="Fedora 24 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:23" version="1" class="inventory">
                <metadata>
                  <title>Fedora 23</title>
                  <affected family="unix">
                    <platform>Fedora 23</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:23"/>
                  <description>The operating system installed on the system is Fedora 23</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:23" comment="Fedora 23 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:22" version="1" class="inventory">
                <metadata>
                  <title>Fedora 22</title>
                  <affected family="unix">
                    <platform>Fedora 22</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:22"/>
                  <description>The operating system installed on the system is Fedora 22</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:22" comment="Fedora 22 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:21" version="1" class="inventory">
                <metadata>
                  <title>Fedora 21</title>
                  <affected family="unix">
                    <platform>Fedora 21</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:21"/>
                  <description>The operating system installed on the system is Fedora 21</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:21" comment="Fedora 21 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:20" version="1" class="inventory">
                <metadata>
                  <title>Fedora 20</title>
                  <affected family="unix">
                    <platform>Fedora 20</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:20"/>
                  <description>The operating system installed on the system is Fedora 20</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:20" comment="Fedora 20 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:19" version="1" class="inventory">
                <metadata>
                  <title>Fedora 19</title>
                  <affected family="unix">
                    <platform>Fedora 19</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:19"/>
                  <description>The operating system installed on the system is Fedora 19</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:19" comment="Fedora 19 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:18" version="1" class="inventory">
                <metadata>
                  <title>Fedora 18</title>
                  <affected family="unix">
                    <platform>Fedora 18</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:18"/>
                  <description>The operating system installed on the system is Fedora 18</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:18" comment="Fedora 18 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:17" version="1" class="inventory">
                <metadata>
                  <title>Fedora 17</title>
                  <affected family="unix">
                    <platform>Fedora 17</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:17"/>
                  <description>The operating system installed on the system is Fedora 17</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:17" comment="Fedora 17 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.fedora:def:16" version="1" class="inventory">
                <metadata>
                  <title>Fedora 16</title>
                  <affected family="unix">
                    <platform>Fedora 16</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:fedoraproject:fedora:16"/>
                  <description>The operating system installed on the system is Fedora 16</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:16" comment="Fedora 16 is installed"/>
                </criteria>
              </definition>
              <definition id="oval:org.open-scap.cpe.centos:def:8" version="1" class="inventory">
                <metadata>
                  <title>Community Enterprise Operating System 8</title>
                  <affected family="unix">
                    <platform>Community Enterprise Operating System 8</platform>
                  </affected>
                  <reference source="CPE" ref_id="cpe:/o:centos:centos:8"/>
                  <description>The operating system installed on the system is Community Enterprise Operating System 8</description>
                </metadata>
                <criteria>
                  <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8" comment="Community Enterprise Operating System is installed"/>
                  <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8000" comment="Community Enterprise Operating System version is 8"/>
                </criteria>
              </definition>
            </definitions>
            <tests>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" check_existence="all_exist" check="all" comment="Check /etc/wrlinux-release for VERSION 8 specification.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:2"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:8"/>
              </ind-def:textfilecontent54_test>
              <unix-def:file_test id="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" check="all" comment="Test presence of /etc/wrlinux-release.">
                <unix-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:1"/>
              </unix-def:file_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" check_existence="all_exist" check="all" comment="Check /etc/os-release for VERSION 1019 specification.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.wrlinux-release:obj:3"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.wrlinux-release:ste:10"/>
              </ind-def:textfilecontent54_test>
              <ind-def:family_test id="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" check="only one" comment="Installed operating system is part of the Unix family.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.unix:obj:1"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.unix:ste:1"/>
              </ind-def:family_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:81" version="1" check="at least one" comment="Windows 8.1 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:81"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:8" version="1" check="at least one" comment="Windows 8 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:8"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:7" version="1" check="at least one" comment="Windows 7 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:7"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2016" version="1" check="at least one" comment="Windows Server 2016 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2016"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2012" version="1" check="at least one" comment="Windows Server 2012 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2012"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:2008" version="1" check="at least one" comment="Windows Server 2008 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:2008"/>
              </win-def:registry_test>
              <win-def:registry_test id="oval:org.open-scap.cpe.windows:tst:10" version="1" check="at least one" comment="Windows 10 is installed">
                <win-def:object object_ref="oval:org.open-scap.cpe.windows:obj:1"/>
                <win-def:state state_ref="oval:org.open-scap.cpe.windows:ste:10"/>
              </win-def:registry_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:12" version="1" check="at least one" comment="sles-release is version 12">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:12"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:11" version="1" check="at least one" comment="sles-release is version 11">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:11"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:10" version="1" check="at least one" comment="sles-release is version 10">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:10"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sles:tst:1" version="1" check="at least one" comment="/etc/sles-release is provided by sles-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sles-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sles:ste:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:12" version="1" check="at least one" comment="sled-release is version 12">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:12"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:11" version="1" check="at least one" comment="sled-release is version 11">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:11"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:10" version="1" check="at least one" comment="sled-release is version 10">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:10"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.sled:tst:1" version="1" check="at least one" comment="/etc/sled-release is provided by sled-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.sled-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.sled:ste:1"/>
              </lin-def:rpminfo_test>
              <ind-def:family_test id="oval:org.open-scap.cpe.sle:tst:1" version="1" check="only one" comment="Installed operating system is part of the Unix family.">
                <ind-def:object object_ref="oval:org.open-scap.cpe.unix:obj:1"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.unix:ste:1"/>
              </ind-def:family_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:7" version="1" check="at least one" comment="sl-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:7"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:6" version="1" check="at least one" comment="sl-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:6"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.scientific:tst:5" version="1" check="at least one" comment="sl-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.scientific:ste:5"/>
              </lin-def:rpmverifyfile_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.rhevh:tst:2" version="1" check="all" comment="RHEVH base RHEL is version 7">
                <ind-def:object object_ref="oval:org.open-scap.cpe.rhevh:obj:2"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.rhevh:ste:2"/>
              </ind-def:textfilecontent54_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.rhevh:tst:1" version="1" check_existence="only_one_exists" check="all" comment="redhat-release-virtualization-host RPM package is installed">
                <lin-def:object object_ref="oval:org.open-scap.cpe.rhevh:obj:1"/>
              </lin-def:rpminfo_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:8" version="1" check="at least one" comment="redhat-release is version 8">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:8"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:7" version="1" check="at least one" comment="redhat-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:7"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:6" version="1" check="at least one" comment="redhat-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:6"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.rhel:tst:5" version="1" check="at least one" comment="redhat-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:5"/>
              </lin-def:rpminfo_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:2" version="1" check="at least one" comment="/etc/redhat-release is provided by redhat-release package">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:2"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1007" version="1" check="at least one" comment="centos-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1007"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1006" version="1" check="at least one" comment="centos-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1006"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpmverifyfile_test id="oval:org.open-scap.cpe.rhel:tst:1005" version="1" check="at least one" comment="centos-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.redhat-release:obj:3"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.rhel:ste:1005"/>
              </lin-def:rpmverifyfile_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:423" version="2" check="at least one" comment="openSUSE-release is version 42.3">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:423"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:422" version="2" check="at least one" comment="openSUSE-release is version 42.2">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:422"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:421" version="1" check="at least one" comment="openSUSE-release is version 42.1">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:421"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:150" version="2" check="at least one" comment="openSUSE-release is version 15.0">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:150"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:132" version="1" check="at least one" comment="openSUSE-release is version 13.2">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:132"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:131" version="1" check="at least one" comment="openSUSE-release is version 13.1">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:131"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:114" version="1" check="at least one" comment="openSUSE-release is version 11.4">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:114"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.opensuse:tst:1" version="1" check="at least one" comment="openSUSE-release is version 11.4">
                <lin-def:object object_ref="oval:org.open-scap.cpe.openSUSE-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.opensuse:ste:2"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:8" version="1" check="at least one" comment="oraclelinux-release is version 8">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:8"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:7" version="1" check="at least one" comment="oraclelinux-release is version 7">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:7"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:6" version="1" check="at least one" comment="oraclelinux-release is version 6">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:6"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.ol:tst:5" version="1" check="at least one" comment="oraclelinux-release is version 5">
                <lin-def:object object_ref="oval:org.open-scap.cpe.oraclelinux-release:obj:1"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.ol:ste:5"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:35" version="1" check="at least one" comment="fedora-release is version Fedora 35">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:35"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:34" version="1" check="at least one" comment="fedora-release is version Fedora 34">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:34"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:33" version="1" check="at least one" comment="fedora-release is version Fedora 33">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:33"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:32" version="1" check="at least one" comment="fedora-release is version Fedora 32">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:32"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:31" version="1" check="at least one" comment="fedora-release is version Fedora 31">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:31"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:30" version="1" check="at least one" comment="fedora-release is version Fedora 30">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:30"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:29" version="1" check="at least one" comment="fedora-release is version Fedora 29">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:29"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:28" version="1" check="at least one" comment="fedora-release is version Fedora 28">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:28"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:27" version="1" check="at least one" comment="fedora-release is version Fedora 27">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:27"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:26" version="1" check="at least one" comment="fedora-release is version Fedora 26">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:26"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:25" version="1" check="at least one" comment="fedora-release is version Fedora 25">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:25"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:24" version="1" check="at least one" comment="fedora-release is version Fedora 24">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:24"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:23" version="1" check="at least one" comment="fedora-release is version Fedora 23">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:23"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:22" version="1" check="at least one" comment="fedora-release is version Fedora 22">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:22"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:21" version="1" check="at least one" comment="fedora-release is version Fedora 21">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:21"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:20" version="1" check="at least one" comment="fedora-release is version Fedora 20">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:20"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:19" version="1" check="at least one" comment="fedora-release is version Fedora 19">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:19"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:18" version="1" check="at least one" comment="fedora-release is version Fedora 18">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:18"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:17" version="1" check="at least one" comment="fedora-release is version Fedora 17">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:17"/>
              </lin-def:rpminfo_test>
              <lin-def:rpminfo_test id="oval:org.open-scap.cpe.fedora:tst:16" version="1" check="at least one" comment="fedora-release is version Fedora 16">
                <lin-def:object object_ref="oval:org.open-scap.cpe.fedora-release:obj:2"/>
                <lin-def:state state_ref="oval:org.open-scap.cpe.fedora:ste:16"/>
              </lin-def:rpminfo_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.centos:tst:8000" version="1" check="all" comment="Check /etc/os-release VERSION_ID is 8">
                <ind-def:object object_ref="oval:org.open-scap.cpe.centos:obj:8000"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.centos:ste:8000"/>
              </ind-def:textfilecontent54_test>
              <ind-def:textfilecontent54_test id="oval:org.open-scap.cpe.centos:tst:8" version="1" check="all" comment="Check /etc/os-release ID is centos">
                <ind-def:object object_ref="oval:org.open-scap.cpe.centos:obj:8"/>
                <ind-def:state state_ref="oval:org.open-scap.cpe.centos:ste:8"/>
              </ind-def:textfilecontent54_test>
            </tests>
            <objects>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.wrlinux-release:obj:3" version="1" comment="Check VERSION specification in /etc/os-release.">
                <ind-def:path>/etc</ind-def:path>
                <ind-def:filename>os-release</ind-def:filename>
                <ind-def:pattern operation="pattern match">^VERSION=.(\d*.\d*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.wrlinux-release:obj:2" version="1" comment="Check VERSION specification in /etc/wrlinux-release.">
                <ind-def:path>/etc</ind-def:path>
                <ind-def:filename>wrlinux-release</ind-def:filename>
                <ind-def:pattern operation="pattern match">^VERSION=.([[:digit:]]*)</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <unix-def:file_object id="oval:org.open-scap.cpe.wrlinux-release:obj:1" version="1">
                <unix-def:filepath>/etc/wrlinux-release</unix-def:filepath>
              </unix-def:file_object>
              <win-def:registry_object id="oval:org.open-scap.cpe.windows:obj:1" version="1">
                <win-def:hive>HKEY_LOCAL_MACHINE</win-def:hive>
                <win-def:key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</win-def:key>
                <win-def:name>ProductName</win-def:name>
              </win-def:registry_object>
              <ind-def:family_object id="oval:org.open-scap.cpe.unix:obj:1" version="1"/>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.sles-release:obj:1" version="1">
                <lin-def:name>sles-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.sled-release:obj:1" version="1">
                <lin-def:name>sled-release</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.rhevh:obj:2" version="1">
                <ind-def:filepath>/etc/redhat-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^Red Hat Enterprise Linux release (\d)\.\d+$</ind-def:pattern>
                <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.rhevh:obj:1" version="1">
                <lin-def:name>redhat-release-virtualization-host</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpmverifyfile_object id="oval:org.open-scap.cpe.redhat-release:obj:3" version="1">
                <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true" noconfigfiles="true" noghostfiles="true"/>
                <lin-def:name operation="pattern match"></lin-def:name>
                <lin-def:epoch operation="pattern match"></lin-def:epoch>
                <lin-def:version operation="pattern match"></lin-def:version>
                <lin-def:release operation="pattern match"></lin-def:release>
                <lin-def:arch operation="pattern match"></lin-def:arch>
                <lin-def:filepath>/etc/redhat-release</lin-def:filepath>
              </lin-def:rpmverifyfile_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.redhat-release:obj:1" version="1">
                <lin-def:name>redhat-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.oraclelinux-release:obj:1" version="1">
                <lin-def:name>oraclelinux-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.openSUSE-release:obj:1" version="1">
                <lin-def:name>openSUSE-release</lin-def:name>
              </lin-def:rpminfo_object>
              <lin-def:rpminfo_object id="oval:org.open-scap.cpe.fedora-release:obj:2" version="1">
                <lin-def:name operation="pattern match">^fedora-release.*</lin-def:name>
              </lin-def:rpminfo_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.centos:obj:8000" version="1" comment="Check os-release VERSION_ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^VERSION_ID="(\d)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
              <ind-def:textfilecontent54_object id="oval:org.open-scap.cpe.centos:obj:8" version="1" comment="Check os-release ID">
                <ind-def:filepath>/etc/os-release</ind-def:filepath>
                <ind-def:pattern operation="pattern match">^ID="(\w+)"$</ind-def:pattern>
                <ind-def:instance datatype="int">1</ind-def:instance>
              </ind-def:textfilecontent54_object>
            </objects>
            <states>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.wrlinux-release:ste:8" version="1" comment="Check the /etc/wrlinux-release file for VERSION 8 specification.">
                <ind-def:subexpression operation="pattern match">8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.wrlinux-release:ste:10" version="1" comment="Check the /etc/os-release file for VERSION 1019 specification.">
                <ind-def:subexpression operation="pattern match">10.19</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:81" version="1">
                <win-def:value operation="pattern match">^Windows 8\.1.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:8" version="1">
                <win-def:value operation="pattern match">^Windows 8.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:7" version="1">
                <win-def:value operation="pattern match">^Windows 7.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2016" version="1">
                <win-def:value operation="pattern match">^.*2016.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2012" version="1">
                <win-def:value operation="pattern match">^.*2012.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:2008" version="1">
                <win-def:value operation="pattern match">^.*2008.*$</win-def:value>
              </win-def:registry_state>
              <win-def:registry_state id="oval:org.open-scap.cpe.windows:ste:10" version="1">
                <win-def:value operation="pattern match">^Windows 10.*$</win-def:value>
              </win-def:registry_state>
              <ind-def:family_state id="oval:org.open-scap.cpe.unix:ste:1" version="1">
                <ind-def:family>unix</ind-def:family>
              </ind-def:family_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:12" version="1">
                <lin-def:version operation="pattern match">^12($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:11" version="1">
                <lin-def:version operation="pattern match">^11($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:10" version="1">
                <lin-def:version operation="pattern match">^10($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sles:ste:1" version="1">
                <lin-def:name operation="pattern match">^sles-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:12" version="1">
                <lin-def:version operation="pattern match">^12($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:11" version="1">
                <lin-def:version operation="pattern match">^11($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:10" version="1">
                <lin-def:version operation="pattern match">^10($|[^\d])</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.sled:ste:1" version="1">
                <lin-def:name operation="pattern match">^sled-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:7" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:6" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.scientific:ste:5" version="1">
                <lin-def:name operation="pattern match">^sl-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.rhevh:ste:2" version="1">
                <ind-def:subexpression operation="pattern match">7</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:8" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^8[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:7" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^7[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:6" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
                <lin-def:version operation="pattern match">^6[^\d]</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.rhel:ste:5" version="1">
                <lin-def:version operation="pattern match">^5[^\d]</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:2" version="1">
                <lin-def:name operation="pattern match">^redhat-release</lin-def:name>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1007" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1006" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpmverifyfile_state id="oval:org.open-scap.cpe.rhel:ste:1005" version="1">
                <lin-def:name operation="pattern match">^centos-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpmverifyfile_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:423" version="1">
                <lin-def:version operation="pattern match">^42.3$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:422" version="1">
                <lin-def:version operation="pattern match">^42.2$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:421" version="1">
                <lin-def:version operation="pattern match">^42.1$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:2" version="1">
                <lin-def:name operation="pattern match">^openSUSE-release</lin-def:name>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:150" version="1">
                <lin-def:version operation="pattern match">^15.0$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:132" version="1">
                <lin-def:version operation="pattern match">^13.2$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:131" version="1">
                <lin-def:version operation="pattern match">^13.1$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.opensuse:ste:114" version="1">
                <lin-def:version operation="pattern match">^11.4$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:8" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^8</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:7" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^7</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:6" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^6</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.ol:ste:5" version="1">
                <lin-def:name operation="pattern match">^oraclelinux-release</lin-def:name>
                <lin-def:version operation="pattern match">^5</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:35" version="1">
                <lin-def:version operation="pattern match">^35$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:34" version="1">
                <lin-def:version operation="pattern match">^34$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:33" version="1">
                <lin-def:version operation="pattern match">^33$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:32" version="1">
                <lin-def:version operation="pattern match">^32$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:31" version="1">
                <lin-def:version operation="pattern match">^31$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:30" version="1">
                <lin-def:version operation="pattern match">^30$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:29" version="1">
                <lin-def:version operation="pattern match">^29$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:28" version="1">
                <lin-def:version operation="pattern match">^28$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:27" version="1">
                <lin-def:version operation="pattern match">^27$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:26" version="1">
                <lin-def:version operation="pattern match">^26$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:25" version="1">
                <lin-def:version operation="pattern match">^25$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:24" version="1">
                <lin-def:version operation="pattern match">^24$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:23" version="1">
                <lin-def:version operation="pattern match">^23$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:22" version="1">
                <lin-def:version operation="pattern match">^22$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:21" version="1">
                <lin-def:version operation="pattern match">^21$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:20" version="1">
                <lin-def:version operation="pattern match">^20$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:19" version="1">
                <lin-def:version operation="pattern match">^19$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:18" version="1">
                <lin-def:version operation="pattern match">^18$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:17" version="1">
                <lin-def:version operation="pattern match">^17$</lin-def:version>
              </lin-def:rpminfo_state>
              <lin-def:rpminfo_state id="oval:org.open-scap.cpe.fedora:ste:16" version="1">
                <lin-def:version operation="pattern match">^16$</lin-def:version>
              </lin-def:rpminfo_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.centos:ste:8000" version="1">
                <ind-def:subexpression>8</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
              <ind-def:textfilecontent54_state id="oval:org.open-scap.cpe.centos:ste:8" version="1">
                <ind-def:subexpression>centos</ind-def:subexpression>
              </ind-def:textfilecontent54_state>
            </states>
          </oval_definitions>
          <results>
            <system>
              <definitions>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:1019" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.wrlinux:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:81" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:81" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:8" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:7" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2016" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2016" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2012" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2012" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:2008" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:2008" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.windows:def:10" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.windows:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sles:def:12" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:12" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sles:def:10" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sles:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sled:def:12" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:12" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sled:def:10" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sled:tst:10" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sle:def:11" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.sle:tst:1" version="1" result="not evaluated"/>
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.sled:tst:11" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.sles:tst:11" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.sle:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criteria operator="OR" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.sles:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.sled:tst:1" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:7" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.scientific:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.scientific:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:7" result="not evaluated" version="1">
                  <criteria operator="OR" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:7" version="1" result="not evaluated"/>
                    <criteria operator="AND" result="not evaluated">
                      <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:1" version="1" result="not evaluated"/>
                      <criterion test_ref="oval:org.open-scap.cpe.rhevh:tst:2" version="1" result="not evaluated"/>
                    </criteria>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1007" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1007" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1006" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1006" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1005" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:1005" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.rhel:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.rhel:tst:2" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:423" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:423" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:422" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:422" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:421" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:421" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:150" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:150" version="2" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:132" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:132" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:131" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:131" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:114" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:114" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.opensuse:def:1" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.opensuse:tst:1" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:8" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:7" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:7" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:6" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:6" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.ol:def:5" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.ol:tst:5" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:35" result="true" version="1">
                  <criteria operator="AND" result="true">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:35" version="1" result="true"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:34" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:34" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:33" result="false" version="1">
                  <criteria operator="AND" result="false">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:33" version="1" result="false"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:32" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:32" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:31" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:31" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:30" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:30" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:29" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:29" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:28" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:28" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:27" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:27" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:26" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:26" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:25" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:25" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:24" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:24" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:23" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:23" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:22" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:22" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:21" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:21" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:20" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:20" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:19" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:19" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:18" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:18" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:17" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:17" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.fedora:def:16" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.fedora:tst:16" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
                <definition definition_id="oval:org.open-scap.cpe.centos:def:8" result="not evaluated" version="1">
                  <criteria operator="AND" result="not evaluated">
                    <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8" version="1" result="not evaluated"/>
                    <criterion test_ref="oval:org.open-scap.cpe.centos:tst:8000" version="1" result="not evaluated"/>
                  </criteria>
                </definition>
              </definitions>
              <tests>
                <test test_id="oval:org.open-scap.cpe.centos:tst:8" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.centos:tst:8000" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:16" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:17" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:18" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:19" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:20" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:21" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:22" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:23" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:24" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:25" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:26" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:27" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:28" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:29" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:30" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:31" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:32" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:33" version="1" check="at least one" result="false">
                  <tested_item item_id="1000923" result="false"/>
                  <tested_item item_id="1000924" result="false"/>
                  <tested_item item_id="1000925" result="false"/>
                </test>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:34" version="1" check="at least one" result="false">
                  <tested_item item_id="1000923" result="false"/>
                  <tested_item item_id="1000924" result="false"/>
                  <tested_item item_id="1000925" result="false"/>
                </test>
                <test test_id="oval:org.open-scap.cpe.fedora:tst:35" version="1" check="at least one" result="true">
                  <tested_item item_id="1000923" result="true"/>
                  <tested_item item_id="1000924" result="true"/>
                  <tested_item item_id="1000925" result="true"/>
                </test>
                <test test_id="oval:org.open-scap.cpe.ol:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.ol:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:114" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:131" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:132" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:150" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:421" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:422" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.opensuse:tst:423" version="2" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1005" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1006" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:1007" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:2" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhel:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhevh:tst:1" version="1" check_existence="only_one_exists" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.rhevh:tst:2" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:5" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:6" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.scientific:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sle:tst:1" version="1" check="only one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:11" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sled:tst:12" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:1" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:11" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.sles:tst:12" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:10" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2008" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2012" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:2016" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:7" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:8" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.windows:tst:81" version="1" check="at least one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:1" version="1" check="only one" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:1019" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:2" version="1" check="all" result="not evaluated"/>
                <test test_id="oval:org.open-scap.cpe.wrlinux:tst:8" version="1" check_existence="all_exist" check="all" result="not evaluated"/>
              </tests>
              <oval_system_characteristics xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix" xmlns:ind-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent" xmlns:lin-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux" xmlns:win-sys="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5 oval-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#independent independent-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#unix unix-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#linux linux-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows windows-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#macos macos-system-characteristics-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd">
                <generator>
                  <oval:product_name>vim</oval:product_name>
                  <oval:schema_version>5.10.1</oval:schema_version>
                  <oval:timestamp>2021-12-22T18:16:18</oval:timestamp>
                </generator>
                <system_info>
                  <os_name>Fedora Linux</os_name>
                  <os_version>35 (Container Image)</os_version>
                  <architecture>x86_64</architecture>
                  <primary_host_name>e98bca166d82</primary_host_name>
                  <interfaces>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>127.0.0.1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>10.0.2.100</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                    <interface>
                      <interface_name>lo</interface_name>
                      <ip_address>::1</ip_address>
                      <mac_address>00:00:00:00:00:00</mac_address>
                    </interface>
                    <interface>
                      <interface_name>tap0</interface_name>
                      <ip_address>fe80::a08a:71ff:fe1f:ac82</ip_address>
                      <mac_address>A2:8A:71:1F:AC:82</mac_address>
                    </interface>
                  </interfaces>
                </system_info>
                <collected_objects>
                  <object id="oval:org.open-scap.cpe.fedora-release:obj:2" version="1" flag="complete">
                    <reference item_ref="1000923"/>
                    <reference item_ref="1000924"/>
                    <reference item_ref="1000925"/>
                  </object>
                </collected_objects>
                <system_data>
                  <lin-sys:rpminfo_item id="1000925" status="exists">
                    <lin-sys:name>fedora-release-common</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-common-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1000924" status="exists">
                    <lin-sys:name>fedora-release-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                  <lin-sys:rpminfo_item id="1000923" status="exists">
                    <lin-sys:name>fedora-release-identity-container</lin-sys:name>
                    <lin-sys:arch>noarch</lin-sys:arch>
                    <lin-sys:epoch>(none)</lin-sys:epoch>
                    <lin-sys:release>35</lin-sys:release>
                    <lin-sys:version>35</lin-sys:version>
                    <lin-sys:evr datatype="evr_string">0:35-35</lin-sys:evr>
                    <lin-sys:signature_keyid>db4639719867c58f</lin-sys:signature_keyid>
                    <lin-sys:extended_name>fedora-release-identity-container-0:35-35.noarch</lin-sys:extended_name>
                  </lin-sys:rpminfo_item>
                </system_data>
              </oval_system_characteristics>
            </system>
          </results>
        </oval_results>
      </arf:content>
    </arf:report>
  </arf:reports>
</arf:asset-report-collection>
